Ineffective pause mechanism in `veRAACToken`
Summary
The veRAACToken contract implements a whenNotPaused modifier but lacks any functionality to modify the pause state. This makes the pause safety mechanism completely ineffective, as the contract can never be paused even in emergency situations.
Vulnerability Details
The contract includes:
The whenNotPaused modifier is used on critical functions like lock, increase, and extend. However, there are no functions in the contract that modify the paused state variable and therefore, it remains permanently set to its default value of false.
Impact
The inability to pause the contract removes a critical safety mechanism used to stop all operations in case of detected vulnerabilities, which makes the contract less secure than its design suggests.
Recommendations
Consider implementing a pause mechanism using OpenZeppelin's Pausable contract.
Lead Judging Commences
veRAACToken lacks the ability to configure `paused` variable
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.