Bald Lace Cyborg - wrong logic is implemented in createMarketWithConfig(), which could revert the function

[sherlock-admin2]

Bald Lace Cyborg

Medium

wrong logic is implemented in createMarketWithConfig(), which could revert the function

Summary

whenever enforceCreationAllowList is true and creationAllowedProfileIds is allowed , then also it will result in reverting of the function

Root Cause

https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/EthosVouch.sol#L667C1-L685C4

/**

• @dev Disables the allow list enforcement
• Anyone may create a market for their own profile.
• @param value true if profile can create their market, false otherwise.
  */
  function setAllowListEnforcement(bool value) public onlyAdmin whenNotPaused {
  enforceCreationAllowList = value;
  }

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

lets consider a scenario when enforce is set to true and user is allowed,

which means createMarket config should succeed and fucntion should go further. But here actually, when it is true it will revert.
so it will prove the comment wrong

Impact

improper functioning of create market, and not working as intended and mentioned in comments

PoC

No response

Mitigation

logic in if function should be changed for enforceAllow