Redacted Cartel contest - codexploder's results

Boosted GMX assets from your favorite liquid token wrapper, Pirex - brought to you by Redacted Cartel.

General Information

Platform: Code4rena

Start Date: 21/11/2022

Pot Size: $90,500 USDC

Total HM: 18

Participants: 101

Period: 7 days

Judge: Picodes

Total Solo HM: 4

Id: 183

League: ETH

Redacted Cartel

Findings Distribution

Researcher Performance

Rank: 71/101

Findings: 1

Award: $53.49

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2022-11-redactedcartel/blob/main/src/PirexGmx.sol#L719 https://github.com/code-423n4/2022-11-redactedcartel/blob/main/src/PirexGmx.sol#L691

Vulnerability details

Impact

The redeem function should be free of any Pausing constraints, otherwise if owner decides to never unpause the contract then full user funds will get stuck in the contract

Proof of Concept

  1. Owner pause the contract using setPauseState

  2. User A wants to redeem his funds using redeemPxGlpETH/redeemPxGlp function

  3. Both function fails since redeem does not work when contract is paused and both functions are using whenNotPaused modifier

Remove the whenNotPaused modifier from redeemPxGlpETH/redeemPxGlp function

#0 - c4-judge

2022-12-04T00:26:56Z

Picodes marked the issue as duplicate of #386

#1 - c4-judge

2022-12-21T07:46:04Z

Picodes marked the issue as not a duplicate

#2 - c4-judge

2022-12-21T07:46:14Z

Picodes changed the severity to QA (Quality Assurance)

#3 - c4-judge

2023-01-01T11:07:38Z

Picodes marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter