Open code423n4 opened 1 year ago
bytes032 marked the issue as primary issue
bytes032 marked the issue as sufficient quality report
witherblock (sponsor) acknowledged
witherblock (sponsor) confirmed
Imo the Warden should have spent more time explaining the finding
This seems to boil down to the ability of depositing into a deprecated vault, no funds are lost, nor denied, and people can redeem
GalloDaSballo changed the severity to QA (Quality Assurance)
Downgrading to QA due to lack of impat
Lines of code
https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L118-L135
Vulnerability details
PerpetualAtlanticVaultLP.deposit()
allows users to deposit WETH to write put options and receive funding payments.However, when
RdpxV2Core
andPerpetualAltanticVault
are paused, new premium and funding payments will be paused as well.Therefore,
deposit()
should be paused in that situation, to prevent new users from depositing WETH that will not receive funding payments.Impact
During the paused state, the protocol continues to allow new deposits into
PerpetualAtlanticVaultLP
but fails to pay any funding.Recommended Mitigation Steps
Add
whenNotPaused()
toPerpetualAtlanticVaultLP.deposit()
Assessed type
Other