Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Can create a marketplace with the same name multiples times causing a conflict.

DanielEth

Summary

In the contract 'SystemConfig' the owner can create a new marketplace calling the function 'createMarketplace'.
In this function, the owner can create multiples marketplaces with the same names, causing a possible conflict between each others.

Impact

If the owner create a marketplace with the same name multiples times, there will not be effectively others marketplaces but there will be only one (since a marketplace is simply taken by encoding the marketplace name).

If this happens, a second marketplace with the same name can be created and the stat '_fixedRatio' of the 'first' marketplace created with that name will be overwritten by the new one.

PoC

Foundry
(The set up for this function is that already used in the function 'setUp' in the protocol file test).

function test_vulnerability_marketplacesWithTheSameNameCanBeCreated() public {
vm.startPrank(user1);
//Here user creates the marketplace "RealMadrid Shop"
systemConfig.createMarketPlace("RealMadrid Shop", false);
//User updates the status of the marketplace to Unitialized
MarketPlaceStatus status = MarketPlaceStatus.UnInitialized;
systemConfig.updateMarketPlaceStatus("RealMadrid Shop", status);
//User creates the marketplace with the same name, changing the value '_fixedratio' from false to true of the "old" marketplace,
systemConfig.createMarketPlace("RealMadrid Shop", true);
}

Tools Used

Manual review, Foundry

Recommendations

First option: Do not allow to create a new marketplace with an already existing name.

Second option: Consider adding a logic that allow to have an id's list of all the marketplaces created with a certain name.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-SystemConfigcreateMarketPlace-unique

Invalid, admins trusted to create marketplaces accordingly with appropriate inputs, as stated in READ.ME. If they do, there will be no issues.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.