sherlock-audit / 2023-05-perennial-judging

12 stars 9 forks source link

mstpr-brainbot - Vaults will fail to work if any of the products of vault are paused #117

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

mstpr-brainbot

medium

Vaults will fail to work if any of the products of vault are paused

Summary

The current system design doesn't check for a product's pause status during a vault's rebalancing process. If a product linked to a vault is paused, it could cause errors during rebalancing, disabling deposit, redemption, and claim operations.

Vulnerability Detail

In the current implementation, the vault does not verify if any of the associated products of a vault are paused during the vault's rebalancing process. If any product linked to a vault is in a paused state, the rebalancing process will run into errors. Consequently, operations such as deposits, redemptions, and claims could become impossible to execute. Moreover, the vault will become non-functional due to a rebalancing revert, impeding its ability to transition to the subsequent epoch as the settlement process is prematurely halted at the rebalancing stage.

Impact

Since this can make the vault non operational I'll label it as high

Code Snippet

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial/contracts/product/Product.sol#L287-L340 notPaused modifier

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial/contracts/controller/UControllerProvider.sol#L67-L71

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L431-L492

Tool used

Manual Review

Recommendation

Check whether any of the associated products are paused, if one of the product is paused than it is wiser to shutdown the other since the hedging will not be possible in the vault for that market

Duplicate of #232