Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Critical configure function in Market.sol is written as internal function but not called by any external function

uncontrolledking

[H-4] Critical configure function in Market.sol is written as internal function but not called by any external function

Description:

A function in market.sol :: configure is written as internal function , according to netspac the function is used to Updates the market's configuration parameters

this below is the full netspac

/// @notice Updates the market's configuration parameters.
/// @dev See {Market.Data} for parameters description.
/// @dev Calls to this function must be protected by an authorization modifier.

the netspac said Calls to this function must be protected by an authorization modifier which means this is an important function that should be called to update the markets configuration

Impact:
With this critical function been internal and no external function protected by an authorization modifier to call it, this will result to function configure been a dead code , and with this the market can not be updated

Proof of Concept:

/// @notice Updates the market's configuration parameters./// @dev See {Market.Data} for parameters description./// @dev Calls to this function must be protected by an authorization modifier.// @check : check if this function is called by an external function and check if the caller is authorizedfunction configure(
uint128 marketId,
uint128 autoDeleverageStartThreshold,
uint128 autoDeleverageEndThreshold,
uint128 autoDeleverageExponentZ
)
internal
{
Data storage self = load(marketId);
self.id = marketId;
self.autoDeleverageStartThreshold = autoDeleverageStartThreshold;
self.autoDeleverageEndThreshold = autoDeleverageEndThreshold;
self.autoDeleverageExponentZ = autoDeleverageExponentZ;
}

Recommended Mitigation:

i recommend writing another external function updateMarketConfiguration which should be protected by an authorization modifier that will call this configure in market.sol

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.