No any external functions in HooksFactory are protected by SphereX

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-08-wildcat/blob/main/src/HooksFactory.sol#L34
https://github.com/code-423n4/2024-08-wildcat/blob/main/src/market/WildcatMarket.sol#L37-L42

Vulnerability details

Impact

The Wildcat team can not manage any external functions in HooksFactory with SphereX

Proof of Concept

The Wildcat protocol states that all external functions are under SphereX protection:

Without going into too much detail here, all external functions are wrapped in a modifier which sanity-checks any given transaction against a training set, reverting said transaction if it deviates too far from expected behaviour.

While HooksFactory is inherited from SphereXProtectedRegisteredBase, it does not use the modifier sphereXGuardExternal for any external functions.
The modifier sphereXGuardExternal is also missed on WildcatMarket#rescueTokens().

Tools Used

Manual review

Recommended Mitigation Steps

Introduce the modifier sphereXGuardExternal for WildcatMarket#rescueTokens() and all external functions in HooksFactory.

Assessed type

Context