016.md

Colossal Chiffon Urchin

Medium

Creates a new reputation market for a profile using a specific market configuration will be created for incorrect market

Summary

_createMarket input based of marketConfigIndex which will be changed one day in removeMarketConfig

Root Cause

E.x. user decied to invest in Deluxe tier which initially has index = 1

    marketConfigs.push(
      MarketConfig({
        initialLiquidity: 50 * DEFAULT_PRICE,
        initialVotes: 1000,
        basePrice: DEFAULT_PRICE
      })
    );

ReputationMarket.sol#L235

Later admin decied to remove delux in favor of another market in removeMarketConfig now market with index =1 will be Premium which means user would invest in another market, which is misleading and a loss to user

Internal pre-conditions

Whenever admin decides to remove market and user create market

External pre-conditions

No response

Attack Path

No response

Impact

Protocol Mislead users to invest in different market with providing more liquidity than user want to. Its impossible to withdraw liquidity in current system until graduation. If create market and remove market happens in the same block, 100% probability to invest in incorrect market

PoC

No response

Mitigation

_createMarket should change input from index to name of the market to not mislead users

  struct MarketConfig {
    uint256 initialLiquidity;
    uint256 initialVotes;
    uint256 basePrice;
+    string name;
  }

  function _createMarket(
    uint256 profileId,
    address recipient,
-    uint256 marketConfigIndex
+    string marketName
  ) private nonReentrant {