Submission Details
Severity:
Lack of `whenNotPaused` modifier in `withdraw()` and `delegate()` function in `TempleGoldStaking`
Summary
Critical modifier whenNotPausedis lacked in withdraw() and delegate() function.
Vulnerability Details
In **TempleGoldStaking**contract, it implement Pausableto pause critical function in emergency mode. whenNotPausedmodifier is implemented in stakeForfunction, but function withdraw()and delegete()aren't:
Function withdraw():
function withdraw(uint256 amount, uint256 index, bool claim) external override {
StakeInfo storage _stakeInfo = _stakeInfos[msg.sender][index];
_withdrawFor(_stakeInfo, msg.sender, msg.sender, index, amount, claim, msg.sender);
}
Function delegate():
function delegate(address delegatee) external override {
return _delegate(msg.sender, delegatee);
}
Impact
Unable to pause these function in case of emergency mode.
Tools Used
Manual review
Recommendations
Add whenNotPaused modifier in withdraw() and delegate() functions.
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Only migrator should be able to perform actions when contract is paused.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.