Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing whenNotPaused modifier

4eyes

Summary

InTokenManager.sol, can be found two functions that lack the necessary whenNotPaused modifier. This oversight allows users to continue depositing funds even when the contract is paused, which could lead to potential risks in emergency scenarios.

Vulnerability Details

The TokenManager.sol contract implements a pause functionality designed to stop specific operations, such as locking additional funds, during emergencies. The withdraw() function correctly uses the whenNotPaused modifier, preventing its execution when the contract is paused. However, the tillIn() and addTokenBalance() functions do not have this modifier applied. This means that even if the contract is paused, users can still execute these functions to deposit additional liquidity, which undermines the purpose of the pause functionality.

Code Snippet

function tillIn(
address _accountAddress,
address _tokenAddress,
uint256 _amount,
bool _isPointToken
)
external
payable
onlyRelatedContracts(tadleFactory, _msgSender())
onlyInTokenWhiteList(_isPointToken, _tokenAddress)
{
/// @notice return if amount is 0
if (_amount == 0) {
return;
}
​
​
address capitalPoolAddr = tadleFactory.relatedContracts(
RelatedContractLibraries.CAPITAL_POOL
);
if (capitalPoolAddr == address(0x0)) {
revert Errors.ContractIsNotDeployed();
}
​
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @notice check msg value
* @dev if msg value is less than _amount, revert
* @dev wrap native token and transfer to capital pool
*/
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
} else {
/// @notice token is ERC20 token
_transfer(
_tokenAddress,
_accountAddress,
capitalPoolAddr,
_amount,
capitalPoolAddr
);
}
​
​
emit TillIn(_accountAddress, _tokenAddress, _amount, _isPointToken);
}
​
​
/**
* @notice Add token balance
* @dev Caller must be related contracts
* @param _tokenBalanceType Token balance type
* @param _accountAddress Account address
* @param _tokenAddress Token address
* @param _amount Claimable amount
*/
function addTokenBalance(
TokenBalanceType _tokenBalanceType,
address _accountAddress,
address _tokenAddress,
uint256 _amount
) external onlyRelatedContracts(tadleFactory, _msgSender()) {
userTokenBalanceMap[_accountAddress][_tokenAddress][
_tokenBalanceType
] += _amount;
​
​
emit AddTokenBalance(
_accountAddress,
_tokenAddress,
_tokenBalanceType,
_amount
);
}

Impact

The lack of the whenNotPaused modifier on the tillIn() and addTokenBalance() functions could result in users continuing to deposit funds into the contract during an emergency. This could expose the contract to further risk, potentially exacerbating the situation that led to the pause. The vulnerability could lead to a scenario where additional funds are locked into the contract during a critical period, potentially leading to financial loss or exploitation.

Tools Used

Manual review

Recommendations

Add whenNotPaused modifier to tillIn() and addTokenBalance().

Updates

Lead Judging Commences

0xnevi Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] finding-Rescuable-pause-no-effect

I believe this is informational and non-acceptable severity because: - A single pause on withdraw to be sufficient to pause the markets during times of emergencies, given that is the only function where collateral/point tokens/native ETH can be pulled from market transactions. - Every tadle market place can be switched offline by the admin via [`updateMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L160-L171) and is checked in market actions via [`checkMarketPlaceStatus`](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/libraries/MarketPlaceLibraries.sol#L54-L67) to be online. This prevents many major market actions including the creation, listing and settlement of offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.