Missing whenNotPaused Modifier on External Functions Involving Funds
Summary
A critical issue has been identified where the whenNotPaused modifier is not applied to external functions that involve handling user funds. The absence of this modifier means that these functions can still be executed even when the contract is in a paused state, which is intended to prevent operations during emergency or maintenance situations. This oversight compromises the security of the contract, as it allows fund-related actions to proceed in potentially unsafe conditions, increasing the risk of unauthorized transactions, loss of funds, and operational inconsistencies.
Vulnerability Details
PreMarket and DeliveryPlace contracts have a number of functions that affect the user balance and funds but none of these functions has a whenNotPaused modifier, which means they can be called even when the protocol has been paused.
Impact
Without the whenNotPaused modifier, these fund-related functions remain callable even when the contract is paused. This could lead to unauthorized or unintended transactions, further exacerbating any issues that prompted the pause.
Tools Used
Manual Review
Recommendations
Add a whenNotPausedmodifier to the functions
Lead Judging Commences
[invalid] finding-Rescuable-pause-no-effect
I believe this is informational and non-acceptable severity because: - A single pause on withdraw to be sufficient to pause the markets during times of emergencies, given that is the only function where collateral/point tokens/native ETH can be pulled from market transactions. - Every tadle market place can be switched offline by the admin via [`updateMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L160-L171) and is checked in market actions via [`checkMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/libraries/MarketPlaceLibraries.sol#L54-L67) to be online. This prevents many major market actions including the creation, listing and settlement of offers.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.