Skip to content

Latest commit

 

History

History
41 lines (23 loc) · 1.89 KB

039.md

File metadata and controls

41 lines (23 loc) · 1.89 KB

Shambolic Opaque Swift

Medium

Immediate market graduation blocks users from selling their votes

Summary

The GRADUATION_WITHDRAWAL contract can immediately graduate any market, causing an abrupt end to trading. This can lock users out of selling their votes, resulting in unrecoverable positions and unexpected losses.

Root Cause

In ReputationMarket.sol#L722C1-L733C4, the function graduateMarket allows an authorized contract (GRADUATION_WITHDRAWAL) to immediately finalize (graduate) a market. There is no waiting period or user grace period before finalizing the market.

Internal Pre-conditions

  1. The GRADUATION_WITHDRAWAL contract is authorized to call graduateMarket. . A market is currently active and has participants holding votes.

External Pre-conditions

No response

Attack Path

  1. The authorized GRADUATION_WITHDRAWAL contract (intentionally or accidentally) calls graduateMarket(profileId).
  2. The market is immediately transitioned to a graduated state, disallowing further buying or selling of votes.
  3. Users holding votes can no longer liquidate them, leaving them locked in a graduated market without a chance to sell before graduation.

Impact

Market participants lose the ability to sell their votes on short notice, potentially resulting in locked positions or financial losses if the price was expected to change. The sudden graduation undermines user trust and disrupts market equilibrium.

PoC

No response

Mitigation

  1. Add a Grace Period: Before finalizing a market, require a timelock or grace period during which users are notified and can sell their votes.
  2. Partial or Phased Graduation: Implement a phased approach allowing users to sell for a set period after a graduation announcement.