search

hats-finance / Velvet-Capital-0x0bb0c08fd9eeaf190064f4c66f11d18182961f77

Core smart contracts of Velvet Capital
Other
0 stars 1 forks source link

Owner can toggle pause/unpause of the protocol rapidly #53

Open hats-bug-reporter[bot] opened 1 week ago

hats-bug-reporter[bot] commented 1 week ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0xa48490d06d7400bc96bbbf18089f1fc9d8d7ebb818562b2708290cf67ad89ee6 Severity: low

Description: Description\ Their are 2 functions to pause the protocol

  1. function setProtocolPause()
  2. function setEmergencyPause()

And there is a concept of cooldown period of 5 minutes to not let anyone toggle the state of the pausing of the protocol rapidly to avoid any inconsistencies in depositing and withdrawing from the protocol.

The check for cooldown is only enforced in the function setEmergencyPause() and there is no such check in the function setProtocolPause() allowing the protocolOwner to toggle the pause rapidly.

Attack Scenario\ Since there is no check in the setProtocolPause() function owner can keep toggling the state to temporary cause a dos in deposit and withdrawal.

This isssue is marked as low since it is centralisation risk.

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional)

langnavina97 commented 1 week ago

This is correct, but if the protocol is paused, users can still withdraw their funds, so there is no risk of users' funds getting stuck.