0xlookman - A malicious user can prevent a signer from registering with a desired hat

[sherlock-admin4]

0xlookman

Medium

A malicious user can prevent a signer from registering with a desired hat

Summary

0xlookman

From the docs of the protocal, it show that an account can have more than one hat.
https://github.com/sherlock-audit/2024-11-hats-protocol/blob/main/hats-zodiac/docs/AUDITING.md#L30-L31

A given ethereum account can wear many hats, but the protocol enforces that a given account cannot have more than 1 copy of a given hat (ie no account’s balance of a given hat must always be 0 or 1).

When registering a signer, the protocal does not allow signers claimedFor to reregister meaning they can not change their hats as long as they still own the registered hat by setting allow reregistration to false. This can utilised by a malicious user by registering a user with a more than one hat with a hat id with which he does not intend to use hence preventing him from using the desired one

Here is a scenario;
-User A has an owner hat and another hat Y.

• User A wants to register with the owner hat to be able to have the owner privilages
• Malicious user B sees this and decides to register user A with hat Y.
• This will prevent user A from ever registering with the owner hat and denying him the privilage to excise being an owner.

https://github.com/sherlock-audit/2024-11-hats-protocol/blob/main/hats-zodiac/docs/AUDITING.md#L30-L31

Imapct
Denial of service to the desired and rightful Privilages.

recommendation

Consider not allowing claiming for.

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

No response