Dangerous delegatecall for a malicous initcode

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/Holographer.sol#L164

Vulnerability details

Impact

Detailed description of the impact of this finding.
In line 164 of contract Holographer, it uses a delegatecall to allow another contract B (HolographRegistryInterface(HolographInterface(holograph).getRegistry())
.getReservedContractTypeAddress(contractType)) to modify the storage slots of Holographer since in delegatecall, the callee will use the same storage slots as its caller. As a result, a malicous callee will be able to use it init() function to revise all the parameters set by Holographer.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/Holographer.sol#L164

Tools Used

Remix

Recommended Mitigation Steps

Avoid using delegatecall unless they are part of the Holograph package, an external contract can be malicous and might compromise the whole Holograph ecosystem, use call instead.

[gzeoneth]

Duplicate of #494

[ACC01ADE]

Delegate calls are only made to internal protocol created and managed contracts.

[gzeoneth]

Consider with #247