Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`updateMarket(...)` does not check if settlement time has elapsed

audinarey

Summary

Owing to the implementation of the updateMarket(...)function, there is a missing check to ensure that the admin does not update the market before the settlement time has elpsed

Vulnerability Details

As shown in the NATSPEC comment below,

File: SystemConfig.sol
112: * @notice Update market when settlement time is passed
​

the function does not check if the settlement time has eleapsed as stated in the NATSPEC comment

function updateMarket( // @audit LOW does not check if settlement time is passed according to the NATSPEC
string calldata _marketPlaceName,
address _tokenAddress,
uint256 _tokenPerPoint,
uint256 _tge,
uint256 _settlementPeriod
) external onlyOwner {
address marketPlace = GenerateAddress.generateMarketPlaceAddress(
_marketPlaceName
);
​
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[
marketPlace
];
​
if (marketPlaceInfo.status != MarketPlaceStatus.Online) {
revert MarketPlaceNotOnline(marketPlaceInfo.status);
}
​
marketPlaceInfo.tokenAddress = _tokenAddress;
marketPlaceInfo.tokenPerPoint = _tokenPerPoint;
marketPlaceInfo.tge = _tge;
marketPlaceInfo.settlementPeriod = _settlementPeriod;
​
emit UpdateMarket(
_marketPlaceName,
marketPlace,
_tokenAddress,
_tokenPerPoint,
_tge,
_settlementPeriod
);
}

Impact

low

Tools Used

Manual review

Recommendations

add a chek to the updateMarketfunction to ensure that the market is not updated before the end of the settlement

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.