Dopex - LowK's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/core/RdpxV2Core.sol#L1016

Vulnerability details

Impact

When the admin pauses the contract RdpxV3core locks anyone to use this contract such as a bond, bondWithDelegate, and withdraw. But a function redeem is still available to use. Any situations that occur like a hack accident or system are under maintenance then anyway, your smart contract is running to continue to get unexpected.

Proof of Concept

The code below does not call a function whenNotPause() to check whether this contract is paused or not.

function redeem(
    uint256 id,
    address to
  ) external returns (uint256 receiptTokenAmount) {
    // Validate bond ID
    _validate(bonds[id].timestamp > 0, 6);
    // Validate if bond has matured
    _validate(block.timestamp > bonds[id].maturity, 7);

    _validate(
      msg.sender == RdpxV2Bond(addresses.receiptTokenBonds).ownerOf(id),
      9
    );

    // Burn the bond token
    // Note requires an approval of the bond token to this contract
    RdpxV2Bond(addresses.receiptTokenBonds).burn(id);

    // transfer receipt tokens to user
    receiptTokenAmount = bonds[id].amount;
    IERC20WithBurn(addresses.rdpxV2ReceiptToken).safeTransfer(
      to,
      receiptTokenAmount
    );

    emit LogRedeem(to, receiptTokenAmount);
  }

To reproduce this vulnerability, let's modify a test called testRedeem() in a /test/rdpxV2-core/Unit.t.sol. After running the test, you will get everything passed. So it is proof of vulnerable

function testRedeem() public {
    rdpxV2Core.bond(1 * 1e18, 0, address(this));
    // ...
    rdpxV2Core.pause(); // <- add this line to test

    // test redeem after expiry
    rdpxV2Bond.approve(address(rdpxV2Core), 0);
    rdpxV2Core.redeem(0, address(1));
    assertEq(rdpxV2Bond.balanceOf(address(this)), 0);
    assertEq(rdpxV2ReceiptToken.balanceOf(address(1)), 25 * 1e16);
    // ...
}

Tools Used

Manually

Recommended Mitigation Steps

Adding the line _whenNotPaused(); into the function redeem().

Assessed type

Invalid Validation