Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

updateMarket() should not be allowed if the are any active offers

vladzaev

Summary

updateMarket() should not be allowed if the are any active offers

Vulnerability Details

Rigth now contract owner can update Markets at any time he wants:

function updateMarket(
string calldata _marketPlaceName,
address _tokenAddress,
uint256 _tokenPerPoint,
uint256 _tge,
uint256 _settlementPeriod
) external onlyOwner {
address marketPlace = GenerateAddress.generateMarketPlaceAddress(
_marketPlaceName
);
​
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[
marketPlace
];
​
if (marketPlaceInfo.status != MarketPlaceStatus.Online) {
revert MarketPlaceNotOnline(marketPlaceInfo.status);
}
​
marketPlaceInfo.tokenAddress = _tokenAddress;
marketPlaceInfo.tokenPerPoint = _tokenPerPoint;
marketPlaceInfo.tge = _tge;
marketPlaceInfo.settlementPeriod = _settlementPeriod;
​
...
}

It should now be allowed to change _tokenAddress when there are active offers on the market, as this could potentially break the logic and lead to a loss of assets.

For example, for now the market token is USDT with 6 decimals. Later it will be updated to WETH with 18 decimals and different asset cost compared to USDT. Some users will see фт unfair advantage and withdraw assets with larget cost.

Impact

It can potentialy breaks the logic and calculations for the protocol

Tools Used

Manual review

Recommendations

Consider checking that there are no active offers at the time of updating.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.