Borrower can never close the market

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarket.sol#L142-L149

Vulnerability details

Impact

The function closeMarket() sets the APR to 0% and does the necessary fund transfers. This function implements a modifier onlyController, this requires that only the controller can make this call. However the controller contract has no method that calls the function closeMarket().

Proof of Concept

  modifier onlyController() {
    if (msg.sender != controller) revert NotController();
    _;
  }

 function closeMarket() external onlyController nonReentrant {}

In the Market Controller contract available at https://github.com/code-423n4/2023-10-wildcat/blob/main/src/WildcatMarketController.sol, there exists no function to call the closeMarket()

Tools Used

Manual Review

Recommended Mitigation Steps

Add a function in the Market Controller contract that calls WildcatMarket.closeMarket()

Assessed type

Other

[c4-pre-sort]

minhquanym marked the issue as duplicate of #147

[c4-judge]

MarioPoneder changed the severity to 2 (Med Risk)

[c4-judge]

MarioPoneder marked the issue as partial-50

[c4-judge]

MarioPoneder changed the severity to 3 (High Risk)