Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`SystemConfig::updateMarket` lacks the logic to verify if the required settlement time is valid.

DuncanDuMond

Summary

The updateMarket function is supposed to update market details "when settlement time has passed," but it does not include any logic to check if the settlement time has indeed passed.

Vulnerability Details

Lines 120-126

function updateMarket(
string calldata _marketPlaceName,
address _tokenAddress,
uint256 _tokenPerPoint,
uint256 _tge,
uint256 _settlementPeriod
) external onlyOwner {

Impact

The variables _tge (Token Generation Event) and _settlementPeriod are set within the function itself, which means there is no pre-existing condition to determine if the settlement time has passed.

Tools Used

Manual review

Recommendations

  1. Add a Check for Settlement Time by introducing a mechanism to track the last update time and compare it with the current time to ensure the settlement period has passed.

  2. If _tge and _settlementPeriod are already part of the market's state, use them to validate the settlement period before allowing an update.

An example fix to the problem is as follows:

function updateMarket(
string calldata _marketPlaceName,
address _tokenAddress,
uint256 _tokenPerPoint,
uint256 _tge,
uint256 _settlementPeriod
) external onlyOwner {
address marketPlace = GenerateAddress.generateMarketPlaceAddress(_marketPlaceName);
MarketPlaceInfo storage marketPlaceInfo = marketPlaceInfoMap[marketPlace];
​
if (marketPlaceInfo.status != MarketPlaceStatus.Online) {
revert MarketPlaceNotOnline(marketPlaceInfo.status);
}
​
// Check if the settlement period has passed
uint256 currentTime = block.timestamp;
if (currentTime < marketPlaceInfo.tge + marketPlaceInfo.settlementPeriod) {
revert SettlementPeriodNotPassed();
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.