Tadle

Summary

Rescuable.sol features a pausing mechanism that is currently only applied to TokenManager::withdraw(...) function. Several critical functions are not protected by a whenNotPaused modifier and could be exposed during emergency pausing.

Vulnerability Details

Quoting README.md:

We demonstrate that markets can not be paused by owner.

The whenNotPaused modifier is used only in the TokenManager::withdraw(...) function:

Here's a list of the CRITICAL functions in the PreMarkets contract that are not covered with the pausing mechanism:

• createOffer: Initiates a new offer with collateral deposit.

• createTaker: Allows a user to take an existing offer, transferring tokens.

• listOffer: Enables listing of a bid offer, potentially with additional collateral.

• closeOffer: Cancels an offer and refunds collateral.

• relistOffer: Reactivates a previously cancelled offer, requiring collateral redeposit.

• abortAskOffer: Terminates an ask offer, refunding remaining collateral.

• abortBidTaker: Cancels a bid taker position, refunding the taker.

These functions handle critical operations involving token transfers, collateral management, and offer state changes. The same case could be made for the rest of contracts in the code-base with critical functions, e.g., TokenManager itself.

Impact

The lack of pausing exposes critical fund flows during emergencies, introducing serious problmes. e.g., loss of funds from continued trading despite the protocol being compromised.

Tools Used

• Manual review.

• OpenZeppelin docs.

Recommendations

Apply whenNotPaused modifier to critical functions.