Core Contracts

Summary

The veRAACToken.sol contract includes the whenNotPaused modifier in all functions, suggesting that the contract supports a pausable mechanism. However, the contract lacks _pause and _unpause functions, rendering the paused state immutable and always returning false. As a result, the contract can never be paused, defeating the purpose of the whenNotPaused modifier.

Vulnerability Details

• The contract includes the whenNotPaused modifier in all functions, intending to prevent operations when the contract is paused.

  [ https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L280 ]

  function extend(uint256 newDuration) external nonReentrant whenNotPaused {

• The paused variable, which determines whether the contract is paused, always returns false because there are no _pause and _unpause functions implemented to change its state.

  [ https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L103 ]

  bool public paused;

• Without a way to modify the paused state, the contract is permanently in an "unpaused" state, making the whenNotPaused modifier ineffective.

Impact

• The pausable mechanism is completely non-functional, leading to a false sense of security for developers and users who assume that the contract can be paused during emergencies.

• If the contract needs to be paused due to a security issue or maintenance, there is no way to stop operations, which could lead to financial losses or exploitation.

Tools Used

Manual Review

Recommendations

Implement _pause and _unpause functions to allow authorized roles (e.g., an admin or governance contract) to toggle the paused state.