Abracadabra Mimswap - hassan-truscova's results

Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/main/src/blast/BlastOnboarding.sol#L214-L216 https://github.com/code-423n4/2024-03-abracadabra-money/blob/main/src/blast/BlastOnboarding.sol#L132-L141

Vulnerability details

Impact

It may discourage people from purchasing the token because you may suspend the withdraw functionality at any point. The users will be unsure if the pause will be lifted after a certain period of time.

Proof of Concept

    function pause() external onlyOwner {
        _pause();
    }

    function withdraw(address token, uint256 amount) external whenNotPaused onlySupportedTokens(token) {
        balances[msg.sender][token].unlocked -= amount;
        balances[msg.sender][token].total -= amount;
        totals[token].unlocked -= amount;
        totals[token].total -= amount;


        token.safeTransfer(msg.sender, amount);


        emit LogWithdraw(msg.sender, token, amount);
    }

Tools Used

manual + in-house

Recommended Mitigation Steps

• Implement Timelock for Pause: Introduce a time-delay mechanism for the pause function, giving users ample time to respond and adjust their positions before the contract is paused.

• Emergency Withdraw Function: Add an emergency function to allow users to withdraw their funds even when the contract is paused. This function should be carefully designed to prevent exploitation while still providing a safe exit for users' funds.

Assessed type

Other