Christmas Dinner

Summary

The contract utilizes pausable tokens such as WBTC which can make the contract unusable.

Vulnerability Details

The contract has three whitelisted tokens - WETH, WBTC and USDC. The tokens are whitelisted and not callback, hook ones (ERC777, ERC1363, etc...) which is prevents possible reentrancy attacks. However, of these three tokens WBTC has the ability to be paused by its governing body. Although funds are not at risk of loss, if WBTC is paused, the contract will be unusable.

Impact

If the token is paused then transfers of tokens into and out of the contract are impossible, which impacts ability to deposit, withdraw and refund, making the contract useless.

Tools Used

Manual review

Recommendations

Implement safeguard measures on the contract e.g emergency patterns to activate them and protect protocol in the event of issues beyond control such as a token used in protocol being paused.