# Call of ````revokeAllRole()```` would fail silently

Elfi Protocol's revokeAllRole() used delete on an EnumerableSet mapping, silently failing to clear roles and bricking revokeRole(), leaving revoked admins active.

- Payout: Contest reward
- Severity: medium
- Program: Elfi Protocol
- Credited: KingNFT
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/80
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AM-6
- Tags: domain:web3 impact:funds-loss impact:privesc kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity RoleAccessControl library (access control storage)
**Root cause:** delete on a mapping(address => EnumerableSet.Bytes32Set) only zeroes the mapping slot, not the EnumerableSet's internal _inner arrays, so contains() still returns true and remove() reverts on stale indices.
**Steps:**
1. Deploy fixture; deployer holds ADMIN role (hasRole returns true).
2. Call `revokeAllRole(deployer)` as deployer.
3. Check `hasRole(deployer, ROLE_ADMIN)` — still returns true.
4. Call `revokeRole(deployer, ROLE_ADMIN)` — reverts because EnumerableSet.remove hits inconsistent internal state.
**How found:** Code reading of RoleAccessControl.revokeAllRole spotted `delete` applied to a struct containing EnumerableSet, a known Solidity pitfall; confirmed with a Hardhat PoC.
**Exploitation:** Not directly weaponized; a compromised or former-employee account retaining ADMIN after revokeAllRole can still call admin functions, e.g. add a malicious facet to drain protocol funds.
**Escalation:** Retained ADMIN role enables adding malicious diamond facet to steal all protocol-held funds.
**Insight:** When auditing access-control libraries, grep for `delete` on structs/mappings whose values are EnumerableSet/EnumerableMap — delete only clears the slot, leaving internal arrays intact so contains() stays true and remove() reverts.