BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

No Emergency Pause / Circuit Breaker

chobby

No on-chain emergency pause, cannot stop deposits/withdraws during emergency

Description

  • The contract lacks any pause or circuit-breaker mechanism. If a critical issue is discovered (e.g., token exploit, admin compromise, or discovered bug), the owner cannot temporarily halt operations to limit damage.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • When there's need door an emergency pause, coils be in times of an exploit

Impact:

  • Funds remain fully exposed while an issue is being investigated.

  • Attackers can continue exploiting until a hard fix is deployed (which may be costly or impossible without pausing).

Proof of Concept

there’s no pause() or paused() function to call. A test shows calling a non-existent pause function fails thereby demonstrating inability to halt operations.

function test_cannot_pause() public {
// calling non-existent pause should revert at compile/call time
(bool ok,) = address(vault).call(abi.encodeWithSignature("pause()"));
assertFalse(ok, "contract should not have pause() function");
}
}

Recommended Mitigation

Add OpenZeppelin Pausable and restrict pause/unpause to owner (or multisig).

+import "@openzeppelin/contracts/security/Pausable.sol";
- contract BriVault is ERC4626, Ownable {
+ contract BriVault is ERC4626, Ownable, Pausable {
...
- function deposit(uint256 assets, address receiver) public override returns (uint256) {
+ function deposit(uint256 assets, address receiver) public override whenNotPaused returns (uint256) {
...
- function withdraw() external winnerSet {
+ function withdraw() external winnerSet whenNotPaused {
...
+ // Admin pause controls
+ function pause() external onlyOwner {
+ _pause();
+ }
+ function unpause() external onlyOwner {
+ _unpause();
+ }+
​
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!