Summary

The SystemConfig smart contract does not implement uniqueness for marketplace names during creation. This issue lead to multiple marketplaces being created with the same name, causing potential confusion and operational issues.

Vulnerability Details

Location : https://github.com/tadle-com/market-evm/blob/8fbea7f4513cbeb0104236927d9051510574e673/src/core/SystemConfig.sol#L90

The createMarketPlace function lacks a check to ensure that marketplace names are unique. As a result , it is possible to create multiple marketplaces with the same name. This can lead to:

• Difficulty in differ and managing multiple marketplaces with identical names.

• Conflicts in handling data and operations associated with these marketplaces.

Impact

While the issue does not directly effect funds or cause severe disruptions, it can result in operational challenges and confusion in managing and differentiating between marketplaces.

Tools Used

Manual Code Review

Recommendations

1. Add a Mapping to Track Used Marketplace Names:
   Create a mapping to keep track of which marketplace names have been used to prevent duplicates.

   mapping(string => bool) private usedMarketPlaceNames;

2. Update createMarketPlace Function:
   Add a function to check if the marketplace name has already been used before allowing the creation of a new marketplace. Store the name in mapping as used upon successful creation.

   function createMarketPlace(

   string calldata _marketPlaceName,

   bool _fixedratio

   ) external onlyOwner {

   // Check if the marketplace name has already been used or not

   (+)require(!usedMarketPlaceNames[_marketPlaceName], "Marketplace name already used");

   ​

   address marketPlace = GenerateAddress.generateMarketPlaceAddress(

   _marketPlaceName

   );

   MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[

   marketPlace

   ];

   ​

   if (marketPlaceInfo.status != MarketPlaceStatus.UnInitialized) {

   revert MarketPlaceAlreadyInitialized();

   }

   ​

   marketPlaceInfo.status = MarketPlaceStatus.Online;

   marketPlaceInfo.fixedratio = _fixedratio;

   ​

   // do mark as marketplace name as used

   (+)usedMarketPlaceNames[_marketPlaceName] = true;

   ​

   emit CreateMarketPlaceInfo(_marketPlaceName, marketPlace, _fixedratio);

   }