Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stake and Withdraw Functions Remain Active During Market Pause While Other Critical Functions Are Protected

0xekkoo

Summary

The stake() and withdraw() functions in BaseGauge remain callable during market pause, creating an inconsistency with other protected functions and potentially allowing users to manipulate staking positions while reward and voting mechanisms are frozen.

Vulnerability Details

The BaseGauge contract implements pause protection on critical functions like getReward() and voteDirection() but fails to apply the same protection to stake() and withdraw() operations.

function getReward() external virtual nonReentrant whenNotPaused updateReward(msg.sender) {
function voteDirection(uint256 direction) public whenNotPaused updateReward(msg.sender) {
function stake(uint256 amount) external nonReentrant updateReward(msg.sender) {
function withdraw(uint256 amount) external nonReentrant updateReward(msg.sender) {

Impact

  • Users can modify staking positions while rewards are frozen

  • Total supply can be manipulated during pause

  • Reward calculations affected through updateReward modifier

  • Position changes possible while voting is disabled

  • Potential for position manipulation before pause is lifted

Tools Used

Manual Review

Recommendations

Add whenNotPaused modifier to stake() and withdraw() functions

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::withdraw, stake, and checkpoint functions lack whenNotPaused modifier, allowing critical state changes even during emergency pause

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::withdraw, stake, and checkpoint functions lack whenNotPaused modifier, allowing critical state changes even during emergency pause

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!