Pause and unpause functions are inaccessible

[howlbot-integration[bot]]

Lines of code

https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/TraitForgeNft/TraitForgeNft.sol#L19 https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/NukeFund/NukeFund.sol#L11 https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/EntropyGenerator/EntropyGenerator.sol#L9 https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/EntityTrading/EntityTrading.sol#L11 https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/DevFund/DevFund.sol#L9 https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/EntityForging/EntityForging.sol#L10

Vulnerability details

Impact

All in-scope contracts of TraitForge inherit from the Pausable contract of OpenZeppelin, a feature designed to allow the pausing and unpausing of contract functionalities in emergency situations or for maintenance. However, (parent) contracts do not expose the _pause() and _unpause() functions and the Pausable contract contains only internal pausing/unpausing functions. As a result, despite inheriting the pausability feature, administrators are unable to utilize these critical controls to pause or resume the contract's operations when needed, potentially leading to issues during periods requiring immediate intervention.

Proof of Concept

Pause and unpause functions of the Pausable contract;

    function _pause() internal virtual whenNotPaused {
        _paused = true;
        emit Paused(_msgSender());
    }

    function _unpause() internal virtual whenPaused {
        _paused = false;
        emit Unpaused(_msgSender());
    }

All in-scope contracts inherit Pausable but do not expose it. An example is EntityTrading.sol, which explicitly tries to use the pausing functionality, as can be seen with the whenNotPaused modifier used in several functions.

Tools Used

Foundry

Recommended Mitigation Steps

To leverage the full capabilities of the Pausable inheritance and enhance the contract's operational security and flexibility, it is recommended to expose the pause and unpause functions in the parent contracts. These should be accessible by the contract owner or other authorized roles, ensuring they can respond effectively to operational needs or emergencies:

    /**
     * @dev Pauses all functions affected by `whenNotPaused`.
     */
    function pause() public onlyOwner {
        _pause();
    }

    /**
     * @dev Unpauses all functions affected by `whenNotPaused`.
     */
    function unpause() public onlyOwner {
        _unpause();
    }

Assessed type

Library

[c4-judge]

koolexcrypto marked the issue as satisfactory

[c4-judge]

koolexcrypto marked the issue as selected for report

[c4-judge]

koolexcrypto changed the severity to 3 (High Risk)