Tadle

Summary

Lack of comprehensive pausability on important functions in pausable contracts.

Vulnerability Details

Several contracts in /core are pausable as they inherit the Rescuable contract but the "whenNotPaused" modifier is not used on several core functions across these contracts. This makes the pausable functionality in the contracts useless. List of these contracts below

• the src/core/TokenManager.sol contract inherits Rescuable and has the pausability function but it doesnt use the pause modifiers in all important functions. Only uses it in the withdraw() function. This means withdraw from the contract can be paused but deposit related functions like tillIn() and addTokenBalance() cant be paused. So when contract is in a paused state users wont be able to withdraw but users can still deposit. In a high risk security event/scenario, it is better to pause deposits and withdrawals instead of pausing only withdrawals as unsuspecting users can still be compromised if they deposit.

• the src/core/SystemConfig.sol contract inherits Rescuable and has the pausability function but it doesnt use the pause modifiers in all important functions/ user facing functions. Almost every function here uses the onlyOwner modifier which ensures access restriction to only admin. But the updateReferrerInfo() doesnt have the onlyOwner() modifier and can be called by a user/protocol participant other than the owner/protocol admin.

• the src/core/PreMarkets.sol contract inherits Rescuable and has the pausability function but it doesnt use the pause modifiers (whenNotPaused/whenPaused) in all important functions/ user facing functions. Pausing this contract does nothing, as users can still create offers, create takers, settle offers, list offers etc

• the src/core/DeliveryPlace.sol contract inherits Rescuable and has the pausability function but it doesnt use the pause modifiers (whenNotPaused/whenPaused) in all important functions/ user facing functions. Pausing this contract does nothing, as users can still close bid offers,close bid takers, settle asks etc

• the src/core/CapitalPool.sol contract inherits Rescuable and has the pausability function but it doesnt use the pause modifiers (whenNotPaused/whenPaused) in all important functions/ user facing functions. Pausing this contract does nothing to the CapitalPool.approve() function.

Impact

Lack of comprehensive pausability on important functions in pausable contracts.

Tools Used

manual review

Recommended Mitigation Steps

implement the whenNotPaused modifier in all user facing/external functions in these contracts