Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Pause/Unpause functionalities are not implemented in pausable contracts

atoko

Summary

the current implementation of the protocol's contracts, which are intended to be pausable by design

Vulnerability Details

In the current implementation of the protocol's contracts, which are intended to be pausable by design (as they inherit from the Pausable contract provided by OpenZeppelin), there is a critical oversight. While these contracts do include internal functions _pause and _unpause since they inherit from pausable, they lack the necessary public or external functions that allow a contract manager or administrator to actually trigger these pause and unpause operations.

Impact

the contract must implement two other public/external pause and unpause functions to allow the manager to pause and unpause the contracts when necessary. None of the aforementioned contracts implement those functions, which means even if those contracts are supposed to be pausable (and have the pause/unpause functionalities), none of them can be paused.
without the corresponding public or external functions to expose these internal mechanisms, the contracts remain permanently in their operational state and cannot be paused when necessary.

Tools Used

Manual Review

Recommendations

Add public/external pause and unpause functions in the TokenManager contracts to allow them to be pausable,

​
Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] finding-Rescuable-pause-no-effect

I believe this is informational and non-acceptable severity because: - A single pause on withdraw to be sufficient to pause the markets during times of emergencies, given that is the only function where collateral/point tokens/native ETH can be pulled from market transactions. - Every tadle market place can be switched offline by the admin via [`updateMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L160-L171) and is checked in market actions via [`checkMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/libraries/MarketPlaceLibraries.sol#L54-L67) to be online. This prevents many major market actions including the creation, listing and settlement of offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.