One app could be registered with multiple ports

Two portIds could point to the same app in ICS26Router. This could only happen in case an app is already registered with a custom portId, because then anyone could add a new IBC app that points to the same address with portId set to an empty string. The function addIBCApp will set the portId in this app to be the hex value of the address of the app, and therefore the app could be accessed via two different portIds. Here is the relevant code:

function addIBCApp(string calldata portId, address app) external {
    string memory newPortId;
    if (bytes(portId).length != 0) {
        _checkRole(PORT_CUSTOMIZER_ROLE);
        newPortId = portId;
    } else {
        newPortId = Strings.toHexString(app);
    }
    //...
}

While it is not currently a security issue, if any app tried to backlist another app using the portId, it might be possible to bypass the blacklist using the method discussed above if the blacklisted app has been registered via a custom portId.