Stader Labs - Deps's results

Lines of code

https://github.com/code-423n4/2023-06-stader/blob/d5f7854fdf70547c6476c00be5d97c85f2c8d064/contracts/Auction.sol#L34

Vulnerability details

Impact

The contract contracts/Auction.sol, even doing import '@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol'; and __Pausable_init();. They have left the public functions to control the state of the contract without declaration, meaning that if there is a problem with the Auction contract it can never change to paused state like ETHx.sol contract can.

Proof of Concept

The contract is being imported here: https://github.com/code-423n4/2023-06-stader/blob/d5f7854fdf70547c6476c00be5d97c85f2c8d064/contracts/Auction.sol#LL11C1-L11C79

The contract is being inherited here: https://github.com/code-423n4/2023-06-stader/blob/d5f7854fdf70547c6476c00be5d97c85f2c8d064/contracts/Auction.sol#LL14C1-L14C121

The contract is being initialized here: https://github.com/code-423n4/2023-06-stader/blob/d5f7854fdf70547c6476c00be5d97c85f2c8d064/contracts/Auction.sol#LL34C9-L35C1

The contract is being used in the following lines: https://github.com/code-423n4/2023-06-stader/blob/d5f7854fdf70547c6476c00be5d97c85f2c8d064/contracts/Auction.sol#L48 https://github.com/code-423n4/2023-06-stader/blob/d5f7854fdf70547c6476c00be5d97c85f2c8d064/contracts/Auction.sol#L62

Tools Used

Manual Audit

Recommended Mitigation Steps

There should have the following code snipet present on ETHx.sol contract:

https://github.com/code-423n4/2023-06-stader/blob/d5f7854fdf70547c6476c00be5d97c85f2c8d064/contracts/ETHx.sol#LL60C5-L75C6

This way the usage of the pausable contract is ensured and the Auction would not have any surprises during its usage.

Assessed type

Other