Mint/Redeem Hook setting can be frontrun

[code423n4]

Lines of code

https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/apps/smart-contracts/core/contracts/PrePOMarket.sol#L109-L117

Vulnerability details

Impact

Mint/Redeem Hooks are not set in the constructor, but with a separate transaction. If the owner wants to add a mint/redeem hook that requires
msg.sender validation, an adversary can back run the market-creation/front-run the hook-setting transaction to allow them to mint/redeem where there normally would be rejected due to some action or requirement being implemented in the mint-hook

Proof of Concept

1. Market is Deployed, _mintHook and _redeemHook == address(0)
2. Adversary mints tokens without any kind of hook validation
3. Owner changes the address of _mintHook to some kind of validation contract.
4. Since the address was zero when the adversary minted, they did not need to meet any contract validation requirements to mint.

Tools Used

Recommended Mitigation Steps

Include IMarketHook parameters for _mintHook and _redeemHook in the constructor so that all mints are required to obey hook rules from the start. The address can be zero if the owner chooses not to include a hook but should have the option to.

[c4-judge]

Picodes marked the issue as duplicate of #312

[c4-judge]

Picodes marked the issue as satisfactory