085.md

Glorious Heather Panther

Medium

Missing Validation for creationCost in addMarketConfig

Summary

The addMarketConfig function does not validate the creationCost parameter, allowing configurations to be added with a creationCost of 0. https://github.com/sherlock-audit/2024-12-ethos-update/blob/main/ethos/packages/contracts/contracts/ReputationMarket.sol#L366

Root Cause

In ReputationMarket::addMarketConfig there is no sanity check for 0 creationCost value.

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

No response

Impact

Users can ceateMarkets at no cost if they use a MarketConfig whose creationCost was not set or is zero.

PoC

No response

Mitigation

add a check to revert if creationCost is zero if (creationCost == 0) revert InvalidMarketConfigOption("Creation cost cannot be zero");