Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Users Can Stake Tokens Even When Contract Is Paused

pelz

Summary

The stake function in BaseGauge does not enforce a pause check, allowing users to continue staking even when the contract is paused. This contradicts the expected behavior of a paused contract, where staking operations should be temporarily halted.

Vulnerability Details

The function currently lacks a whenNotPaused modifier or a manual check for the paused state:

function stake(uint256 amount) external nonReentrant updateReward(msg.sender) {
if (amount == 0) revert InvalidAmount();
_totalSupply += amount;
_balances[msg.sender] += amount;
stakingToken.safeTransferFrom(msg.sender, address(this), amount);
emit Staked(msg.sender, amount);
}

Impact

  • Users can unknowingly stake in a paused contract, leading to unexpected behavior.

  • Potential security risks if pausing was meant to prevent further interactions due to an emergency situation.

  • Violation of expected contract behavior, reducing trust and reliability.

Tools Used

Manual code review.

Recommendations

Enforce a pause check using either:

  1. Adding the whenNotPaused modifier:

    function stake(uint256 amount) external nonReentrant whenNotPaused updateReward(msg.sender) {

  2. Explicitly reverting if paused:

    if (paused()) revert ContractPaused();
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::withdraw, stake, and checkpoint functions lack whenNotPaused modifier, allowing critical state changes even during emergency pause

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::withdraw, stake, and checkpoint functions lack whenNotPaused modifier, allowing critical state changes even during emergency pause

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!