Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Users Can Stake Tokens Even When Contract Is Paused

pelz

Summary

The stake function in BaseGauge does not enforce a pause check, allowing users to continue staking even when the contract is paused. This contradicts the expected behavior of a paused contract, where staking operations should be temporarily halted.

Vulnerability Details

The function currently lacks a whenNotPaused modifier or a manual check for the paused state:

function stake(uint256 amount) external nonReentrant updateReward(msg.sender) {
if (amount == 0) revert InvalidAmount();
_totalSupply += amount;
_balances[msg.sender] += amount;
stakingToken.safeTransferFrom(msg.sender, address(this), amount);
emit Staked(msg.sender, amount);
}

Impact

  • Users can unknowingly stake in a paused contract, leading to unexpected behavior.

  • Potential security risks if pausing was meant to prevent further interactions due to an emergency situation.

  • Violation of expected contract behavior, reducing trust and reliability.

Tools Used

Manual code review.

Recommendations

Enforce a pause check using either:

  1. Adding the whenNotPaused modifier:

    function stake(uint256 amount) external nonReentrant whenNotPaused updateReward(msg.sender) {

  2. Explicitly reverting if paused:

    if (paused()) revert ContractPaused();
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::withdraw, stake, and checkpoint functions lack whenNotPaused modifier, allowing critical state changes even during emergency pause

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::withdraw, stake, and checkpoint functions lack whenNotPaused modifier, allowing critical state changes even during emergency pause

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.