061.md

Ripe Sage Ant

Medium

Removal of market config will impact parallel market creation

Summary

Removal of marketConfig swaps elements in array. When users create new market, they specify config index in array. As a result, they will create market with incorrect config because removal swaps indexes.

Root Cause

• In ReputationMarket.removeMarketConfig() it swaps indexes.
• In ReputationMarket._createMarket() it uses config index to specify which type of config to use.

Internal pre-conditions

1. Admin needs to call removeMarketConfig() to remove non-last index, for example 1
2. At the same time there must be tx in mempool createMarket() which uses config with same index, i.e. 1

External pre-conditions

Attack Path

1. Let's say there are 3 configs in array: [config0, config1, config2]
2. User submits tx to create Market with config1, i.e. configIndex = 0
3. Admin removes marketConfig 1. So entries are swapped and now are following: [config0, config2]
4. User's tx is executed. Market with config2 is created by mistake.

Impact

The market creator creates market with incorrect config. There is no functionality to create market with correct config anymore.

PoC

No response

Mitigation

Do not swap entries in array marketConfigs. Or add arguments to specify wanted config in createMarket()