Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing validation in SystemConfig:UpdateMarket leads to owners being able to update users markets info even when settlement period have not reach

kingnull

Description:
updateMarket function Updates the market when settlement time is passed, now a user can provide marketPlace info to the protocol to the protocol with premature _settlementPeriod time, and the function will execute when the protocol runs it, this updateMarket function is expected to only run when _settlementPeriod has passed, so without a validation on if the provided params, if the _settlementPeriod is greater than 72 hours then the function will pass even when _settlementPeriod provided is less than 72 hours

Impact:
this function is only designed to be called only when settlement time has passed, but due to the missing validation protocol can called this function with users provided params and it will pass even when the settlement period have not yet started

Proof of concept

function updateMarket(
string calldata _marketPlaceName,
address _tokenAddress,
uint256 _tokenPerPoint,
uint256 _tge,
uint256 _settlementPeriod
) external onlyOwner {
address marketPlace = GenerateAddress.generateMarketPlaceAddress(_marketPlaceName);
​
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[marketPlace];
​
if (marketPlaceInfo.status != MarketPlaceStatus.Online) {
revert MarketPlaceNotOnline(marketPlaceInfo.status);
}
​
marketPlaceInfo.tokenAddress = _tokenAddress;
marketPlaceInfo.tokenPerPoint = _tokenPerPoint;
marketPlaceInfo.tge = _tge;
marketPlaceInfo.settlementPeriod = _settlementPeriod;
​
emit UpdateMarket(_marketPlaceName, marketPlace, _tokenAddress, _tokenPerPoint, _tge, _settlementPeriod);
}

Proof of Code:

function test_settlementPeriod() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace, address(mockUSDCToken), 1000, 0.01 * 1e18, 12000, 300, OfferType.Ask, OfferSettleType.Turbo
)
);
​
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateMarket(
"Backpack", //marketplace name
address(mockPointToken), //token address
0.01 * 1e18, //token per point
block.timestamp - 1, // tge
55 hours // settlement period
);
​
// 3600 in time = 1 hour
vm.expectRevert();
​
vm.prank(user1);
systemConfig.updateMarket(
"Backpack", //marketplace name
address(mockPointToken), //token address
0.01 * 1e18, //token per point
block.timestamp - 1, // tge
5 hours // settlement period
);
}

Recommended Mitigation:
include a validation in the updateMarket function so that it can only be updated only when settlement time is passed

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.