SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Missing Pause Guard on fund()

Author Revealed upon completion

Root + Impact

Description

  • The fund() function lacks a pause check while other admin functions (updateVerifier(), emergencyWithdraw()) require the contract to be paused. This inconsistency allows the owner to add funds while the hunt is active, potentially interfering with hunt economics at critical moments.

// file: TreasureHunt.sol
**Inconsistency**
- `updateVerifier()`: requires `paused` (L264)
- `emergencyWithdraw()`: requires `paused` (L274)
- `fund()`: NO pause check (L236-L237 only)

Risk

Likelihood:

  • Reason 1

Impact:

  • Owner behavior inconsistent across admin functions

  • Could fund contract at inappropriate times during active hunts

  • Minor inconsistency in protocol design

Proof of Concept

​

Recommended Mitigation

Add require(paused, "THE_CONTRACT_MUST_BE_PAUSED") to fund() for consistency:

function fund() external payable {
require(msg.sender==owner, "ONLY_OWNER_CAN_FUND");
+ require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.value > 0, "NO_ETH_SENT");
emit Funded(msg.value, address(this).balance);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!