Tadle

Summary

The documentation states that the admin should be able to pause all markets, but the actual implementation only uses the pause functionality in the TokenManager::withdraw function. There is no direct function to pause all markets, the pause functionality is only available through the Rescuable contract, which means individual contracts or functions cannot be paused. function

Vulnerability Details

Documented Functionality:

• The documentation states: "The Owner can pause all the markets"

• Actual Implementation

  • Pause functionality is only used in TokenManager::withdraw function

  • No direct function to pause all markets exists

  • Pause functionality is only accessible through the Rescuable contract makes Owner can't pause or unpause specific contract or functions.

Impact

- Inability to quickly pause all markets in case of an emergency, increasing vulnerability to potential attacks or bugs
- incomplete emergency controls, potentially compromising the ability to protect user funds in critical situations

Tools Used

Manual code Review

Recommendations

1. Implement a centralized pause function that allows the admin to pause all markets at once. This function should be accessible directly by the admin and should trigger the pause across all relevant contracts

2. Use onlyOwner modifier in all the function that should be paused due an Exploits or emergency or should be .