No any external functions in HooksFactory are protected by SphereX

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-wildcat/blob/main/src/HooksFactory.sol#L34
https://github.com/code-423n4/2024-08-wildcat/blob/main/src/market/WildcatMarket.sol#L37-L42

Vulnerability details

Impact

The Wildcat team can not manage any external functions in HooksFactory with SphereX

Proof of Concept

The Wildcat protocol states that all external functions are under SphereX protection:

Without going into too much detail here, all external functions are wrapped in a modifier which sanity-checks any given transaction against a training set, reverting said transaction if it deviates too far from expected behaviour.

While HooksFactory is inherited from SphereXProtectedRegisteredBase, it does not use the modifier sphereXGuardExternal for any external functions.
The modifier sphereXGuardExternal is also missed on WildcatMarket#rescueTokens().

Tools Used

Manual review

Recommended Mitigation Steps

Introduce the modifier sphereXGuardExternal for WildcatMarket#rescueTokens() and all external functions in HooksFactory.

Assessed type

Context

[d1ll0n]

This is low/informational - the docs should be updated to reflect that this applies primarily to the markets themselves. The factory and rescue functions are access-gated and it's difficult to think of any likely scenario where any of these functions could be used in an attack by anyone other than the arch controller owner.

[3docSec]

Protocol not working as per spec/doc -> L

[c4-judge]

3docSec changed the severity to QA (Quality Assurance)

[c4-judge]

3docSec marked the issue as grade-b