Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`EMERGENCY_ADMIN` cannot pause BoostController

inh3l

Summary

The emergency shutdown function is controlled by the wrong role.

Vulnerability Details

In BoostController, there is the EMERGENCY_ADMIN role which is meant to control the emergency shutdown function.

However, the setEmergencyShutdown function is only accessible to the MANAGER_ROLE, which creates a mismatch between the role and the function and other contracts as emergency roles in other contracts are handled by EMERGENCY_ADMIN role.

function setEmergencyShutdown(bool paused) external onlyRole(MANAGER_ROLE) {
if (paused) {
_pause();//@audit emergency pasuer cannot pause contracts
} else {
_unpause();
}
emit EmergencyShutdown(msg.sender, paused);
}

Impact

In case of an emergency, the actual emergency role cannot pause contracts.

Tools Used

Manual Review

Recommendations

Set the access control for setEmergencyShutdown to EMERGENCY_ADMIN instead.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!