`renounceOwnership()` can be called in the `Rescuable` contract when contract is paused.
Summary
The renounceOwnership() function can be called even when the Rescuable contract is paused.
Vulnerability Details
Users will be unable to withdraw their funds if the contract is paused, and the funds will be permanently locked if the owner renounces ownership during pause.
Impact
Users will be unable to withdraw their funds, as TokenManager.withdraw() will be permanently locked.
Tools Used
Manual review.
Recommendations
Override the renounceOwnership() function with a whenNotPaused modifier.
Lead Judging Commences
[invalid] finding-Admin-Errors-Malicious
The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.