Steadefi

Summary

The emergencyResume() function adds liquidity back into the pool during resume from pause. However, it does not check if liquidity was already added by a previous call.

Vulnerability Details

If emergencyResume() ever reverts or fails after inserting liquidity, calling it again would add a duplicate entry without detection. This could lock up tokens long-term in the pool or introduce surplus.

Reproduction Steps:

1. Call emergencyResume() to add initial liquidity

2. Mimic a failure that reverts the transaction

3. Call emergencyResume() a second time

4. Detect duplicate liquidity insertion

Impact

Funds may become permanently stuck in pool

Tools Used

Manual Review

Recommendations

Add checks that no liquidity exists already before insertion. For example, verify zero liquidity token balances owned by contract. Revert on any duplicates to avoid risk of locked or excess funds.