Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Owner can update market before settlement time is passed

tinnohofficial

Summary

SystemConfig::updateMarket function can be called any time by the owner even before settlement time has passed, this gives the owner the ability to manipulate the market before the traders can settle their offers or orders thus griefing the traders.

Vulnerability Details

The function SystemConfig::updateMarket as seen below does not have any check to ensure settlement time has passed even though the notice clearly says this should have been implemented @notice Update market when settlement time is passed

/**
* @notice Update market when settlement time is passed
* @param _marketPlaceName Market place name
* @param _tokenAddress Token address
* @param _tokenPerPoint Token per point
* @param _tge TGE
* @param _settlementPeriod Settlement period
* @notice Caller must be owner
*/
// @audit I don't see any check to see if settlement time has passed
function updateMarket(
string calldata _marketPlaceName,
address _tokenAddress,
uint256 _tokenPerPoint,
uint256 _tge,
uint256 _settlementPeriod
) external onlyOwner {
address marketPlace = GenerateAddress.generateMarketPlaceAddress(
_marketPlaceName
);
​
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[
marketPlace
];
​
if (marketPlaceInfo.status != MarketPlaceStatus.Online) {
revert MarketPlaceNotOnline(marketPlaceInfo.status);
}
​
marketPlaceInfo.tokenAddress = _tokenAddress;
marketPlaceInfo.tokenPerPoint = _tokenPerPoint;
marketPlaceInfo.tge = _tge;
marketPlaceInfo.settlementPeriod = _settlementPeriod;
​
emit UpdateMarket(
_marketPlaceName,
marketPlace,
_tokenAddress,
_tokenPerPoint,
_tge,
_settlementPeriod
);
}

Impact

The owner can manipulate market (at any time) and set the tge to a further future date and thus make the traders unable to settle the offers and order

Tools Used

Manual Review

Recommendations

Add conditional checks in the SystemConfig::updateMarket to ensure that settlement time has passed like the notice says.

Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.