Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

systemConfig:updateMarketPlaceStatus() doesn't check if marketPlace exists/register or not

0xaraj

Summary

systemConfig:updateMarketPlaceStatus() doesn't check if marketPlace exists/register or not

Vulnerability Details

Owner can update the status of a marketPlace using systemConfig:updateMarketPlaceStatus(), but it doesn't check if the marketPlace is register or not before updating its state.

function updateMarketPlaceStatus(string calldata _marketPlaceName, MarketPlaceStatus _status) external onlyOwner {
//@audit it doesn't check if marketplace exist or not
address marketPlace = GenerateAddress.generateMarketPlaceAddress(_marketPlaceName);
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[marketPlace];
marketPlaceInfo.status = _status;
}

Impact

Status of an unregister marketPlace can be updated

Tools Used

Manual Review

Recommendations

Check the status of marketPlace before updating it

function updateMarketPlaceStatus(string calldata _marketPlaceName, MarketPlaceStatus _status) external onlyOwner {
address marketPlace = GenerateAddress.generateMarketPlaceAddress(_marketPlaceName);
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[marketPlace];
+ if (marketPlaceInfo.status = MarketPlaceStatus.UnInitialized) {
+ revert MarketPlaceDoesNotExists();
+ }
marketPlaceInfo.status = _status;
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!