Operations Can Occur While Contract Intended to be Paused
Summary
Key functions that alter contract state, such as borrow(), repay(), add/removeLiquidity() do not check if the contract is currently in a paused state before proceeding.
Functions Affected: borrow(), repay(), addLiquidity(), removeLiquidity().
Vulnerability Details
This means actions can continue even when a pause is meant to suspend all activity for maintenance or upgrades.
Reproduction Steps:
Pause contract using pause functionality
Call function like borrow()
Confirm action was not blocked during pause
Impact
Pause functionality is bypassed, losing intended pause protection
Tools Used
Manual Review
Recommendations
All state-changing operations should validate the contract is not paused before executing. Revert if paused to enforce suspensions.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.