The Wildcat Protocol - zaevlad's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L142 https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarketBase.sol#L136 https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarketBase.sol#L119

Vulnerability details

Impact

Markets can not be closed.

Proof of Concept

Markets can be closed to prevent any withdrawals or deposits in it. For that purpose closeMarket() functions should be called:

  function closeMarket() external onlyController nonReentrant {
   ...
  }

The problem that it can be called only by Controller contract.

  modifier onlyController() {
    if (msg.sender != controller) revert NotController();
    _;
  }

And there is no function in Controller contract to implement this call, so markets can not be closed.

Tools Used

Manual review

Recommended Mitigation Steps

Provide an additional functions in the Controller contract to be able to close markets.

Assessed type

Context