Submission Details
Impact:
Likelihood:
Missing Pause Guard on fund()
Root + Impact
Description
The
fund()function lacks a pause check while other admin functions (updateVerifier(),emergencyWithdraw()) require the contract to be paused. This inconsistency allows the owner to add funds while the hunt is active, potentially interfering with hunt economics at critical moments.
// file: TreasureHunt.sol
**Inconsistency**
- `updateVerifier()`: requires `paused` (L264)
- `emergencyWithdraw()`: requires `paused` (L274)
- `fund()`: NO pause check (L236-L237 only)
Risk
Likelihood:
Reason 1
Impact:
Owner behavior inconsistent across admin functions
Could fund contract at inappropriate times during active hunts
Minor inconsistency in protocol design
Proof of Concept
Recommended Mitigation
Add require(paused, "THE_CONTRACT_MUST_BE_PAUSED") to fund() for consistency:
function fund() external payable {
require(msg.sender==owner, "ONLY_OWNER_CAN_FUND");
+ require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.value > 0, "NO_ETH_SENT");
emit Funded(msg.value, address(this).balance);
}
Rewards breakdown
nSLOC
220This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.