Sensitive variables should not be able to be changed easily

[code423n4]

Handle

tensors

Vulnerability details

As discussed in the previous issue, auctionMultiplier and auctionDecrment are very sensitive variables that can produce large changes in the ibRatio after a settleAuction. A factory change in these variables could affect ongoing and future auctions, causing

If developers accidentally incorrectly update these amounts during an auction it could cause problems (described in a previously submitted issue). If an attacker could somehow get access to these variables he can drain funds from on going auctions in a manner similar to the previously described attack (from a different issue, manipulating newRatio to be > ibRatio).

https://github.com/code-423n4/2021-10-defiprotocol/blob/7ca848f2779e2e64ed0b4756c02f0137ecd73e50/contracts/contracts/Factory.sol#L43-L49

Recommendation:
Make these sensitive variables immutable, or at least make sure developers are aware the potential effects changes will have on the ibRatio's of auctions that are occuring.

[GalloDaSballo]

Finding is valid, in lack of a specific POC, I'm downgrading to low