The owner of MultiSigWallet can also be replaced through above process. However, the owner could be replaced to address(0) if somehow the owners made a mistake. Additionally, if the total number of owners equals to threshold required before incorrect owner replacing, there would be no enough qualified owners to correct the mistake after the transaction was executed.
Impact
MultiSigWallet will be inoperable
Any assets in MultiSigWallet will be locked forever
Risk Breakdown
Difficulty to Exploit: Hard
Recommendation
Check if newOwner is address(0):
function replaceOwner(address owner, address newOwner) public onlyWallet ownerExists(owner) ownerDoesNotExist(newOwner)+ notNull(newOwner) { for (uint i=0; i<owners.length; i++) if (owners[i] == owner) { owners[i] = newOwner; break; } isOwner[owner] = false; isOwner[newOwner] = true; OwnerRemoval(owner); OwnerAddition(newOwner); }
Run forge test --fork-url MAINNET_URL --chain-id 1 --fork-block-number 18620472 --match-test testUpdateOwner(replace MAINNET_URL with your Ethereum RPC URL to test: