The Pause feature is not correctly implemented in the contracts
Summary
The contracts of the protocol can't be fully paused in case of o hack, as the pausable feature is not implemented correctly.
Vulnerability Details
The Rescuable contract is a base contract for the 5 main contracts of the tadle protocol, this contract implement, ownable and pauseable features for the core contracts, the pausable feature is not being fully implemented in the contracts, as the only function that implement the whenNotPaused modifier is the withdraw function, but no other function implement a pause, this mean that in case of a security breach or any problem in the contracts accounting that require to pause the contract's function will fail to fulfill his duty, as the only function that can be paused is the withdraw function, but the rest of the functions will be available to use for all user.
for example if an accounting problem that give the user more tokens than it should be is detected, the protocol will attempt to stop the use of the contract calling the setPauseStatus function, but this function will only pause the withdraw function while the other functions that give the users more tokens are still available to use,
Impact
The core contracts of the protocol can't be fully paused, which can allow the users to interact with other functions that may be vulnerable or have other problems.
Tools Used
Manual Review.
Recommendations
Fully implement the pausable feature in the rest of the external functions of the contracts.
Lead Judging Commences
[invalid] finding-Rescuable-pause-no-effect
I believe this is informational and non-acceptable severity because: - A single pause on withdraw to be sufficient to pause the markets during times of emergencies, given that is the only function where collateral/point tokens/native ETH can be pulled from market transactions. - Every tadle market place can be switched offline by the admin via [`updateMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L160-L171) and is checked in market actions via [`checkMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/libraries/MarketPlaceLibraries.sol#L54-L67) to be online. This prevents many major market actions including the creation, listing and settlement of offers.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.