Tadle

Summary

TokenManager contract has been reviewed, and it was found that several critical functions lack the whenNotPaused modifier. This omission could lead to various issues, including state inconsistencies, security risks, and management confusion during periods when the contract is paused. It is crucial to ensure that all functions related to state changes, fund management, and key business logic are appropriately protected to prevent operations when the contract is paused.

Vulnerability Details

Several functions in TokenManager contract do not include the whenNotPaused modifier. This means that these functions can still be called even when the contract is paused, leading to potential issues such as:

1. State Inconsistencies: Users can continue to call the tillIn function to deposit tokens while the withdraw function is paused, leading to an imbalance and user frustration.

2. Fund Security Risks: Allowing the tillIn function to operate during a contract pause could exacerbate security vulnerabilities, enabling attackers to exploit the contract.

3. Management Confusion: Functions like updateTokenWhiteListed could still be called by the owner during a pause, leading to unnecessary or erroneous changes and complicating the resolution of the issues that caused the pause.

Impact

The lack of the whenNotPaused modifier on critical functions can result in:

1. State Inconsistencies: Users can deposit tokens without being able to withdraw them, causing a mismatch in user balances and potential user dissatisfaction.

2. Increased Security Risks: Attackers could exploit vulnerabilities even during a contract pause, potentially leading to further financial loss or compromise of the contract's integrity.

3. Operational Confusion: The contract owner might make changes to the token whitelist or other configurations during a pause, complicating the management and resolution of the issues that necessitated the pause.

Tools Used

Manual Review

Recommendations

Ensure that all functions involved in state changes, fund management, and key business logic include the whenNotPaused modifier. This will prevent these functions from being called when the contract is paused, maintaining consistency and security.