M-02 MitigationConfirmed

[c4-bot-10]

Lines of code

Vulnerability details

Lines of code

Vulnerability details

C4 issue

M-02: Withdrawals and Claims are meant to be pausable, but it is not possible in practice

Link to issue

Comments

The WithdrawQueue contract’s original implementation does not include the whenNotPaused modifier on the withdraw or claim functions, even though the Renzo protocol documentation mentions the protocol has the ability to pause/unpause deposits and withdrawals.

As a result, neither the withdraw nor the claim functions can be paused if needed. This could pose a problem if the functionality needs to be paused.

Mitigation

PR: Pull Request 87 - M02FIX

The mitigation adds the whenNotPaused modifier to the withdraw and claim functions in the WithdrawQueue contract. This allows the functions to be paused when necessary.

function claim(uint256 withdrawRequestIndex) external nonReentrant whenNotPaused {
    ...
}

function withdraw(uint256 _amount, address _assetOut) external nonReentrant whenNotPaused {
    ...
}

Test

New test cases have been added to ensure the correct functioning of the whenNotPaused modifier, and all tests are passing.

Contract: WithdrawQueueForkTest

Tests:

• test_WithdrawQueueConfig
• test_UserWithdrawClaim

Conclusion

The addition of the whenNotPaused modifier to the withdraw and claim functions ensures that these functions can be paused if necessary.

[c4-judge]

alcueca marked the issue as confirmed for report

[c4-judge]

alcueca marked the issue as satisfactory