Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Settlement Period Validation in SystemConfig:updateMarket Allows Premature Market Updates

ZeroProtocol

Description:

updateMarket function is intended to update the market only when the settlement period has passed.
Currently, there's no validation to check if the settlement period has actually passed.
This allows owner to update markets (provided by users) prematurely even when _settlementPeriod is still less than 72 hours

Impact:

owner can call updateMarket even when the settlement period hasn't started.
This can lead to unauthorized market updates.

Proof of Concept:

function updateMarket(
string calldata _marketPlaceName,
address _tokenAddress,
uint256 _tokenPerPoint,
uint256 _tge,
uint256 _settlementPeriod
) external onlyOwner {
address marketPlace = GenerateAddress.generateMarketPlaceAddress(_marketPlaceName);
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[marketPlace];
​
if (marketPlaceInfo.status != MarketPlaceStatus.Online) {
revert MarketPlaceNotOnline(marketPlaceInfo.status);
}
​
marketPlaceInfo.tokenAddress = _tokenAddress;
marketPlaceInfo.tokenPerPoint = _tokenPerPoint;
marketPlaceInfo.tge = _tge;
marketPlaceInfo.settlementPeriod = _settlementPeriod;
​
emit UpdateMarket(_marketPlaceName, marketPlace, _tokenAddress, _tokenPerPoint, _tge, _settlementPeriod);
}

Recommended Mitigation
Add a validation check in the updateMarket function to ensure that the settlement period has passed before the market can be updated

Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.