admin can set marketplace to malicious address

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-illuminate/blob/3ca41a9f529980b17fdc67baf8cbee5a8035afab/lender/Lender.sol#L145

Vulnerability details

Impact

admin could setMarketPlace() with a malicious contract that is upgradeable or doesn't contain the correct address for the fixed rate markets, leading to user funds being lost or stolen.

Proof of Concept

admin can set marketPlace to any address.
https://github.com/code-423n4/2022-06-illuminate/blob/3ca41a9f529980b17fdc67baf8cbee5a8035afab/redeemer/Redeemer.sol#L70-L76

    function setMarketPlace(address m) external authorized(admin) returns (bool) {
        if (marketPlace != address(0)) {
            revert Exists('marketplace');
        }
        marketPlace = m;
        return true;
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Only allow whitelisted marketPlace addresses that can legitimately be used to fetch the addresses of all the fixed rate markets.

[KenzoAgada]

And who will set the whitelisted marketplace addresses...?

[sourabhmarathe]

Duplicate of #316.