Renzo - 0xBeastBoy's results

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/519e518f2d8dec9acf6482b84a181e403070d22d/contracts/Withdraw/WithdrawQueue.sol#L139

Vulnerability details

Impact

The WithdrawQueue contract has defined pause and unpause functions but they haven't been utilized in the contract. No modifier like whenNotPaused type is defined and used with the function that shouldn't be operational if the contract is paused.

Without the "whenNotPaused" modifier, functions within the contract can still be invoked even when the contract is paused. This undermines the purpose of pausing the contract, as critical operations may continue to execute. Continued execution of functions during a paused state may result in unintended behavior, inconsistent state changes, or unexpected interactions with external systems or users. Users would be able to claim or withdraw even contract is paused.

Proof of Concept

See the following code:

 /**
     * @notice  Pause the contract
     * @dev     Permissioned call (onlyWithdrawQueueAdmin)
     */
    function pause() external onlyWithdrawQueueAdmin {
        _pause();
    }

    /**
     * @notice  Unpause the contract
     * @dev     Permissioned call (onlyWithdrawQueueAdmin)
     */
    function unpause() external onlyWithdrawQueueAdmin {
        _unpause();
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Modify the contract's functions to include the whenNotPaused modifier, ensuring that they can only be executed when the contract is not in a paused state.

Assessed type

ETH-Transfer