Removal of Multisig members will corrupt data structures
The Mozaic Multisig (the senate) can remove council members using the TYPE_DEL_OWNER operation:\\n```\\n        if(proposals[_proposalId].actionType == TYPE_DEL_OWNER) {\\n                (address _owner) = abi.decode(proposals[_proposalId].payload, (address));\\n        require(contains(_owner) != 0, "Invalid owner address");\\n            uint index = contains(_owner);\\n                for (uint256 i = index; i < councilMembers.length - 1; i++) {\\n            councilMembers[i] = councilMembers[i + 1];\\n        }\\n            councilMembers.pop();\\n                 proposals[_proposalId].executed = true;\\n                     isCouncil[_owner] = false;\\n          }\\n```\\n\\nThe code finds the owner's index in the councilMembers array, copies all subsequent members downwards, and deletes the last element. Finally, it deletes the isCouncil[_owner] entry. The issue is actually in the contains() function.\\n```\\n       function contains(address _owner) public view returns (uint) {\\n             for (uint i = 1; i <= councilMembers.length; i++) {\\n       if (councilMembers[i - 1] == _owner) {\\n                return i;\\n            }\\n        }\\n        return 0;\\n        }\\n```\\n\\nThe function returns the index following the owner's index. Therefore, the intended owner is not deleted from councilMembers, instead the one after it is. The `submitProposal()` and `confirmTransaction()` privileged functions will not be affected by the bug, as they filter by isCouncil. However, the corruption of councilMembers will make deleting the member following the currently deleted owner fail, as deletion relies on finding the member in councilMembers.
Fix the `contains()` function to return the correct index of _owner
```\\n        if(proposals[_proposalId].actionType == TYPE_DEL_OWNER) {\\n                (address _owner) = abi.decode(proposals[_proposalId].payload, (address));\\n        require(contains(_owner) != 0, "Invalid owner address");\\n            uint index = contains(_owner);\\n                for (uint256 i = index; i < councilMembers.length - 1; i++) {\\n            councilMembers[i] = councilMembers[i + 1];\\n        }\\n            councilMembers.pop();\\n                 proposals[_proposalId].executed = true;\\n                     isCouncil[_owner] = false;\\n          }\\n```\\n