Tadle

Summary

Most of the contracts in scope contain critical functions that cannot be paused in case of an emergency.

Vulnerability Details

The contracts in scope are pausable as they inherit Rescuable.sol, which holds the pause/unpause functionality, that allows the owner to pause the contracts in case of an emergency.

Contracts in scope such as TokenManager.sol, CapitalPool.sol, DeliveryPlace.sol, PreMarkets.sol, SystemConfig.sol all inherit the Rescuable contract, making them pausable, but for the most part, their functions do not hold a whenNotPaused modifier. In fact, only the withdraw function in TokenManager.sol can potentially be paused, which opens the protocol up to great centralization risk as the owner can easily prevent users from being able to get their funds. And as a rule of thumb, also, based on major protocol implementations, functions to add funds to a protocol should be pausable in case of emergencies, and functions to remove tokens from protocol should always be open so that users can easily rescue their funds.

But major critical functions like tillIn, addTokenBalance, createOffer, createTaker, listOffer, relistOffer, settledAskOffer, settledAskTaker, closeBidOffer, closeBidTaker, settleAskMaker and settleAskTaker are all very important functions which cannot be paused, even though they arguably should be, since they funnel funds into the protocol.

Impact

In case of an emergency (a hack or something of that sort), protocol will not be able to pause these functions, exposing the users to serious risks.

Tools Used

Recommendations

Add the whenNotPaused modifier to needed functions.