Submission Details
Severity:
No check for "self.initialized" in create
Summary
There is no check for the self.initialized in the PerpMarket.if self.initialized is already true you can create a new market.
Vulnerability Details
function create(CreateParams memory params) internal {
Data storage self = load(params.marketId);
@> if (self.id != 0) {
revert Errors.MarketAlreadyExists(params.marketId);
}
self.id = params.marketId;
self.initialized = true;
self.configuration.update(
MarketConfiguration.Data({
name: params.name,
symbol: params.symbol,
priceAdapter: params.priceAdapter,
initialMarginRateX18: params.initialMarginRateX18,
maintenanceMarginRateX18: params.maintenanceMarginRateX18,
maxOpenInterest: params.maxOpenInterest,
maxSkew: params.maxSkew,
maxFundingVelocity: params.maxFundingVelocity,
minTradeSizeX18: params.minTradeSizeX18,
skewScale: params.skewScale,
orderFees: params.orderFees,
priceFeedHeartbeatSeconds: params.priceFeedHeartbeatSeconds
})
);
SettlementConfiguration.update(
params.marketId, SettlementConfiguration.MARKET_ORDER_CONFIGURATION_ID, params.marketOrderConfiguration
);
SettlementConfiguration.update(
params.marketId,
SettlementConfiguration.OFFCHAIN_ORDERS_CONFIGURATION_ID,
params.offchainOrdersConfiguration
);
}
}
}
Impact
New market can be created when self.initialized is already true.
Tools Used
Recommendations
if (self.id != 0||self.initialized) {
revert Errors.MarketAlreadyExists(params.marketId);
}
Updates
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.