Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Improvements Needed in SystemConfig Contract Functions for Better Robustness and Usability

0x5chn0uf

Summary

The SystemConfig contract has several functions (createMarketPlace, updateMarket, and updateMarketPlaceStatus) that could benefit from improvements to enhance robustness and usability. The main issues identified are:

  • No check for an empty marketplace name in createMarketPlace.

  • The createMarketPlace function doesn't return the generated marketplace address.

  • The updateMarketPlaceStatus function does not verify if the marketplace exists before updating its status.

Vulnerability Details

The current implementation doesn't leverage the generated address:

function createMarketPlace(
string calldata _marketPlaceName,
bool _fixedratio
) external onlyOwner {
@> address marketPlace = GenerateAddress.generateMarketPlaceAddress(
_marketPlaceName
); // @audit - What if _marketPlaceName is empty string?
// ...
​
// Why create an address and not returning it for future update?
emit CreateMarketPlaceInfo(_marketPlaceName, marketPlace, _fixedratio);
}

And subsequently, one of the update function:

function updateMarketPlaceStatus(
@> string calldata _marketPlaceName, // @audit - Why not pass the address in the parameter ...
MarketPlaceStatus _status
) external onlyOwner {
@> address marketPlace = GenerateAddress.generateMarketPlaceAddress( // ... instead of retrieving the address this way
_marketPlaceName
);
// ...
}

Impact

These issues could potentially lead to:

  • Unexpected behavior with empty marketplace names.

  • Difficulty in tracking newly created marketplace addresses.

Tools Used

Manual review

Recommendations

Add a check for empty marketplace names and consider returning the generated marketplace address to be used in the updateX function:

function createMarketPlace(
string calldata _marketPlaceName,
bool _fixedratio
+ ) external onlyOwner returns (address) {
+ require(bytes(_marketPlaceName).length > 0, "Marketplace name cannot be empty");
address marketPlace = GenerateAddress.generateMarketPlaceAddress(
_marketPlaceName
);
// ...
​
emit CreateMarketPlaceInfo(_marketPlaceName, marketPlace, _fixedratio);
+ return marketPlace;
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.