<!-- canonical: https://0xsimao.com/findings/mitosis-executor-disable-disables-wrong -->

# StrategyExecutor::disableStrategy() disables the wrong strategy

Medium · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024

Finding 3S-Mitosis-M03 of the Mitosis security review.

- Protocol: https://mitosis.org/
- Report: /reports/mitosis
- Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf

---

### Description

StrategyExecutor::disableStrategy() removes a strategy from the enabled array by
moving the last element to the to be deleted element and popping. However, the check to
move the element is incorrect, if (enabled.length > 1) enabled[i] =
enabled[enabled.length - 1];. This will pop the last strategy incorrectly.
Additionally, the id to disable could be sent as an argument to save gas on the lookup and
the loop can break after finding the index.

### Recommendation

The element must be copied when it is not the last one (if it is the last one, it should just be
popped). Thus, the correct check is
if (i != enabled.length - 1) enabled[i] = enabled[enabled.length - 1];.

### Status

Addressed in [#4f60215](https://github.com/mitosis-org/evm/pull/204/commits/4f602156c62b0982d905a152dda1c1f5879be48b).
