Return Value is Not Validated

[code423n4]

Handle

leastwood

Vulnerability details

Impact

The circuitBreaker() function in RCMarket.sol is utilised in the event an oracle never provides a response to a RealityCards question. The function makes an external call to the RCOrderbook.sol contract through the closeMarket() function. If for some reason the orderbook was unable to be closed, this would never be checked in the circuitBreaker() function.

Proof of Concept

https://github.com/code-423n4/2021-08-realitycards/blob/main/contracts/RCMarket.sol#L1215-L1223

Tools Used

Manual code review

Recommended Mitigation Steps

Ensure this is intended behaviour, or otherwise validate the response of orderbook.closeMarket(). Another option would be to emit the result of the external call in the LogStateChange event, alongside the state change.

[Splidge]

We have decided that given the extra complexity added to the contracts since the circuitBreaker was first implemented it will no longer be able to perform all the required functions and so it will be removed.
If this call to the orderbook fails (or is removed) then users would not have their rentalRates reduced and so their funds would slowly be drained until the foreclose.
We also have setAmicableResolution which can be used in the event of an oracle failure.

[Splidge]

circuitBreaker removed here