WildcatMarketBase Line 97
When a new market is deployed, its name and prefix are generated by appending the underlying assets name and symbol to the name and symbol prefixes provided by the borrower. In the audit description, this is explained as Code4rena deploying a market and passing Code4rena as name prefix and C4 as symbol prefix.
A malicious borrower could exploit this functionality to deploy markets for other well-known assets with the same Code4rena prefixes, potentially tricking lenders into lending them money and mimicking other borrowers. This could lead to confusion and potentially fraudulent activities.
The recommended solution for this is to let each borrower choose a borrower identifier (that gets issued to them by Wildcat). This, in the Code4rena example, would be the Code4rena and C4 strings. Now the hashes (hashes instead of strings to save gas on storage cost) of those identifiers get stored onchain whenever a new borrower gets added. Whenever Code4rena deploys a new market they pass their identifier, as well as a chosen Postfix, which would allow them to deploy multiple markets for the same asset (for example, with different interest rates). The protocol then verifies if the identifiers match the hash and revert if that is not the case. The market mame would then, for example, look like this Code4renaShortTermDAI.
