Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing `whenNotPaused` modifier on majority of functions in scope

0xshoonya

Summary

Most of the critical functions in PreMarket.sol and DeliveryPlace.sol do not implement the whenNotPaused modifier, despite inheriting from the Rescuable contract which provides pausing functionality. This leaves the protocol vulnerable to potential risks as operations cannot be temporarily halted during unforeseen events or attacks.

Vulnerability Details

Although all major contracts in scope inherit from Rescuable, which implements pausing functionality, only the withdraw function in TokenManager.sol uses the whenNotPaused modifier. All the functions in PreMarket.sol and DeliveryPlace.sol lacks any pausing mechanism, meaning they can still be executed even when the protocol should be paused.

Here are some examples of functions missing the whenNotPaused modifier:

PreMarket.sol

function createOffer(CreateOfferParams calldata params) external payable {
function createTaker(address _offer, uint256 _points) external payable {
function listOffer( address _stock,uint256 _amount,uint256 _collateralRate) external payable {
function closeOffer(address _stock, address _offer) external {
function relistOffer(address _stock, address _offer) external payable {
function abortAskOffer(address _stock, address _offer) external {
function abortBidTaker(address _stock, address _offer) external {

DeliveryPlace.sol

function closeBidTaker(address _stock) external {
function settleAskMaker(address _offer, uint256 _settledPoints) external {
function settleAskTaker(address _stock, uint256 _settledPoints) external {

Impact

Pausing functionality do not work as intended. The lack of pausing functionality on critical functions means that the protocol cannot effectively halt operations during emergencies.

Tools Used

Manual Review

Recommendations

Add whenNotPaused modifier in all other functions

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] finding-Rescuable-pause-no-effect

I believe this is informational and non-acceptable severity because: - A single pause on withdraw to be sufficient to pause the markets during times of emergencies, given that is the only function where collateral/point tokens/native ETH can be pulled from market transactions. - Every tadle market place can be switched offline by the admin via [`updateMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L160-L171) and is checked in market actions via [`checkMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/libraries/MarketPlaceLibraries.sol#L54-L67) to be online. This prevents many major market actions including the creation, listing and settlement of offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.