The Wildcat Protocol - said's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L142-L161 https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarketBase.sol#L136-L139

Vulnerability details

Impact

closeMarket is a functionality available within the market that allows borrowers to repay all their debts and close the market. This function is essential when borrowers no longer need a loan and want to cease all market operations. As a result, no further deposits are allowed, and no more interest accrues. However, closeMarket has an onlyController modifier, and there is no function inside the controller that can trigger this closeMarket functionality, making it impossible for borrowers to close the market.

Proof of Concept

It can be observed that market's closeMarket has onlyController modifier.

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L142-L161

  function closeMarket() external onlyController nonReentrant {
    MarketState memory state = _getUpdatedState();
    state.annualInterestBips = 0;
    state.isClosed = true;
    state.reserveRatioBips = 0;
    if (_withdrawalData.unpaidBatches.length() > 0) {
      revert CloseMarketWithUnpaidWithdrawals();
    }
    uint256 currentlyHeld = totalAssets();
    uint256 totalDebts = state.totalDebts();
    if (currentlyHeld < totalDebts) {
      // Transfer remaining debts from borrower
      asset.safeTransferFrom(borrower, address(this), totalDebts - currentlyHeld);
    } else if (currentlyHeld > totalDebts) {
      // Transfer excess assets to borrower
      asset.safeTransfer(borrower, currentlyHeld - totalDebts);
    }
    _writeState(state);
    emit MarketClosed(block.timestamp);
  }

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarketBase.sol#L136-L139

  modifier onlyController() {
    if (msg.sender != controller) revert NotController();
    _;
  }

But there is no function inside controller that trigger this closeMarket, making it impossible for borrower to close market and stop all operations inside the market.

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/WildcatMarketController.sol

Tools Used

Manual review

Recommended Mitigation Steps

Add functionality inside controller that trigger closeMarket

Assessed type

Error