Contract Resumed Without Ensuring Prior Pause
Summary
The emergencyResume() and processEmergencyResume() functions are meant to transition the contract back to an open state after an emergency pause.
Vulnerability Details
However, neither function validates that the contract is currently in the paused state before resuming normal operations. This allows resuming without the contract ever having been paused before.
Reproduction Steps:
Call processEmergencyResume() without pausing first
Operations resume even though pause was bypassed
Impact
Pause flag may no longer reflect actual status
Tools Used
Manual Review
Recommendations
Add checks that the contract status is paused before enabling normal usage again. Revert otherwise to ensure an expected state transition of pause -> resume occurs.
Lead Judging Commences
Insufficient status transition control on emergency pause/resume
Insufficient status transition control on emergency pause/resume
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.