Submitted by leastwood, also found by 0xsanson, gpersoon, hickuphh3 and JMukesh
The variable, marketWhitelist, is never initialized in the contract RCTreasury.sol. As a result, the function marketWhitelistCheck()  does not perform a proper check on whitelisted users for a restricted market. Additionally, the function will always return true, even if a market wishes to restrict its users to a specific role.
The initial state variable is defined in RCTreasury.sol L75.
The state variable marketWhitelist is accessed in the function RCTreasury.marketWhitelistCheck() at RCTreasury.sol L269-L281.
The function RCTreasury.marketWhitelistCheck() is called in RCMarket.newRental() at RCMarket.sol L758-L761. The comment indicates that there should be some ability to restrict certain markets to specific whitelists, however, there are no methods in RCTreasury that allow a market creator to enable this functionality.
Recommend ensuring this behavior is intended. If this is not the case, consider adding a function that enables a market creator to restrict their market to a specific role by whitelisting users.
Splidge (Reality Cards) confirmed and disagreed with severity:
0xean (judge) commented:
Splidge (Reality Cards) patched:
