Missing Pause/Unpause Mechanism
Summary
The protocol lacks a pause/unpause mechanism. Making it vulnerable to critical failures, exploits or unforeseen issues. Without ability to pause operations, the system can not mitigate ongoing attacks, halt faulty logic, or respond to external failures.
NOTE: Although, the deposit function only has the paused but other critical functions that users interact with are missing the pause/unpause mechanism (e.g., withdraw)
Vulnerability details
Observe that no functions check for a paused state before executing trades, deposits, or withdrawals.
Simulate an external dependency failure (e.g., GMX downtime ) and note that the system continue operating under incorrect conditions
Attempts to manually stop execution during an emergency
— There is no way to halt user interactions
This exploit has happened to some several protocols in the past of not implementing the pause and unpause mechanism.
Impact
No emergency shutdown
Uncontrolled execution during failures
Tools Used
Manual Review
Recommendations
Introduce a pause/ unpause mechanism, controlled by a governance multisig or emergency admin.
Lead Judging Commences
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.