# Change of operators possible from old operators

AxelarGateway's execute loop never clears currentOperators, so multiple transferOperatorship commands in one batch all succeed, letting old operators rotate out all other keys at once.

- Payout: Audit contest
- Severity: medium
- Program: Axelar Network
- Found by: Lambda
- Disclosed: 2022-10-06
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-07-axelar#m-05
- Library page: http://bugbountylibrary.com/r/c4%3A2022-07-axelar%3AM-05
- Tags: area:web3 domain:web3 impact:privesc kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AxelarGateway.sol execute() command loop (Solidity smart contract)
**Root cause:** currentOperators mapping is not set to false when an operator is transferred inside the execute loop, so the authorization check still passes for subsequent transferOperatorship commands in the same batch.
**Steps:**
1. Submit an execute call containing multiple `transferOperatorship` commands signed by the current operators.
2. Each command passes the currentOperators check because the mapping is never updated during the loop.
3. All transfers succeed, replacing operators repeatedly until OLD_KEY_RETENTION is exhausted for all other keys.
**How found:** Code review of the execute loop noticed currentOperators was only checked, never updated, when processing transferOperatorship commands, suggesting repeated commands in one batch would all pass.
**Exploitation:** A malicious current-operator majority batches many transferOperatorship commands into a single execute call; since currentOperators is never cleared mid-loop, every command validates, letting them install their own operator set and evict all other valid operators in one transaction instead of OLD_KEY_RETENTION separate txs.
**Escalation:** Repeating transfers within one batch can push past OLD_KEY_RETENTION, giving the signers control of the complete set of currently valid operators.
**Insight:** In batched command dispatchers, check whether authorization state mutated by one command is re-read for later commands in the same loop; stale in-memory auth mappings let a single batch replay privileged actions.