Overflow in Mode Type

[code423n4]

Handle

leastwood

Vulnerability details

Impact

An invalid input _mode to the function RCFactory.createMarket() will not revert until the event LogMarketCreated2 attempts to cast the input to Mode of type enum. This leads to wasted gas and an overall diminished user experience.

Proof of Concept

https://github.com/code-423n4/2021-08-realitycards/blob/main/contracts/RCFactory.sol#L636-L767

The above link represents the affected function. If input uint32 _mode is set as 3, the corresponding cast to IRCMarket.Mode(_mode) in RCFactory.sol:L725 will cause an overflow error with no relevant revert message to indicate the direct cause of the issue.

Tools Used

Manual code review

Recommended Mitigation Steps

Consider adding a check at the beginning of RCFactory.createMarket() to validate the input uint32 _mode by performing an upper bounds check, i.e. require(_mode <= 2).

[Splidge]

This is almost the reverse of issue 9 in the last Code423 contest where the checks were required to be removed for gas efficiency.
Given the disputed nature of the changes and the minimal benefit it will have, we will not be changing this right now.
I'll leave it up to the judges to decide if this should be marked as disputed (as it's in conflict with a previous issue) or acknowledged.

[0xean]

marking as a possible gas optimization rather than a low risk issue