Steadefi

Summary

The protocol implements an emergencyPause function to be called by approved Keepers in an emergency situation. This function is designed to convert all liquidity pool tokens back to the underlying assets and hold them in the vault, also pausing all vault activities, including asset deposits, borrows, or rebalancing. However, the function fails to consider ongoing process such as deposits, withdrawals, compounding, or rebalancing, which could result in incomplete actions and potential loss of funds.

Vulnerability Details

The emergencyPause function changes the vault's status to "Paused", preventing any asset deposits, borrows, or rebalancing. However, if the function is executed while an ongoing process is underway, it could prevent the completion of that transaction. This is due to the fact that in-progress transactions rely on the vault's status for their completion logic to execute successfully.

Assuming an afterDepositExecution callback should trigger, its completion would be blocked by the paused status set by an emergencyPause call. This causes the callback to take no further action, preventing users from receiving any vault shares they should be entitled to post-deposit.

Impact

Any in-progress transaction is not accounted for when the emergency pause is activated resulting in incomplete processes and a disruption of the protocol's accounting or a loss of funds. Furthermore the execution fee refund will be sent back to the keeper that called emergencyPause instead of the user.

Tools Used

Manual analysis

Recommendations

Implement additional functionality within the emergencyPause function to ensure that ongoing transactions are accounted for before and the protocols accounting is correctly updated.