Tadle

Summary

The PreMarkets.sol contract inherits from the Rescuable contract, which provides functionality to pause the contract during emergencies and rescue lost funds. However, the critical createOffer function in the PreMarkets contract does not implement the whenNotPaused modifier, which could lead to security risks during paused states.

Vulnerability Details

The Rescuable contract is designed to protect the protocol by allowing the contract owner to pause operations during emergencies or when vulnerabilities are detected. This pause functionality is critical to prevent unauthorized or harmful actions during these periods.

However, the PreMarkets contract's createOffer function, which is a key function for creating market offers, does not implement the whenNotPaused modifier. This omission means that the function can still be executed even when the contract is paused, potentially leading to unintended consequences or security breaches.

Impact

• Security Breach: During a paused state, critical functions like createOffer should be suspended to prevent any unauthorized actions. If such functions remain active, it can undermine the purpose of pausing the contract, potentially allowing harmful transactions to occur.

• Inconsistent Behavior: The lack of a pause check can lead to inconsistencies in the contract's behavior, where some functions are paused, but others, including critical ones, remain active.

• Increased Risk During Emergencies: The ability to create new offers during a paused state could be exploited by malicious actors, especially during emergencies or known vulnerabilities.

Tools Used

Manual Review

Recommendations

Add whenNotPaused Modifier: Implement the whenNotPaused modifier on the createOffer function and any other critical functions that should not be executed while the contract is paused.