c4-bot-7 commented 8 months ago

Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/blast/BlastOnboarding.sol#L164

Vulnerability details

Impact

Misiing whennotpaused modifier in function claimTokenYields , users still claim even protocol is paused

Proof of Concept

function claimTokenYields(address[] memory tokens) external onlyOwner {
    for (uint256 i = 0; i < tokens.length; i++) {
        if (!supportedTokens[tokens[i]]) {
            revert ErrUnsupportedToken();
        }
        if (registry.nativeYieldTokens(tokens[i])) {
            BlastYields.claimAllTokenYields(tokens[i], feeTo);
        }
    }
}

Tools Used

Recommended Mitigation Steps

function claimTokenYields(address[] memory tokens) external Whennotpaused onlyOwner {
    for (uint256 i = 0; i < tokens.length; i++) {
        if (!supportedTokens[tokens[i]]) {
            revert ErrUnsupportedToken();
        }
        if (registry.nativeYieldTokens(tokens[i])) {
            BlastYields.claimAllTokenYields(tokens[i], feeTo);
        }
    }
}