The Wildcat Protocol - TuringConsulting's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L142

Vulnerability details

Impact

Wildcat Market' closeMarket() function allows the market controller to close the market, setting its APR to 0% and marking it as closed.

In order to only allow the Market's controller to close the market, an onlyController modifier is added, which enforces the msg.sender to only be the controller:

// WilcatMarketBase.sol
modifier onlyController() {
    if (msg.sender != controller) revert NotController();
    _;
}

// WilcatMarket.sol
function closeMarket() external onlyController nonReentrant {
    ...
}

The problem is that the market controller does not have a function to close the market, which effectively renders the closeMarket() not executable. Checking WildcatMarketController.sol, it is not possible to find a function that allows to close the market by calling the closeMarket() function.

Proof of Concept

It is hard to provide a test that proves the vulnerability given that it comes from the lack of code being implemented. To fully understand the issue, it is recommended to:

1. Check the WildcatMarketController.sol to be aware of the lack of code that allows closing the market

2. Review the tests that allow the closeMarket() function to be tested. Checking the WildcatMarket.t.sol test file, we can see how ALL the functions that test closing a market use the asAccount modifier to prank the call as a controller, which is used to bypass the onlyController modifier in WildcatMarket.sol. Then, the closeMarket() function is directly called, without executing a function in the controller:

function test_closeMarket_TransferExcessAssets() external asAccount(address(controller)) {
    // Borrow 80% of deposits then request withdrawal of 100% of deposits
    _depositBorrowWithdraw(alice, 1e18, 8e17, 1e18);
    asset.mint(address(market), 1e18);
    vm.expectEmit(address(asset));
    emit Transfer(address(market), borrower, 2e17);
    market.closeMarket();
  }

Tools Used

Manual review, foundry

Recommended Mitigation Steps

Add a function in WildcatMarketController.sol that allows the market to be closed.

Assessed type

Other