In Emergency Situations, Users are Unable to Withdraw Their Assets (stEXA)

Summary

The inability to withdraw assets during emergencies is caused by the whenNotPaused modifier in the StakedEXA.sol#_update() function.

Vulnerability Detail

In emergency situations, the contract administrator has the ability to pause the contract by invoking StakedEXA.sol#pause().

  /// @notice Sets the pause state to true in case of emergency, triggered by an authorized account.
  function pause() external onlyPausingRoles {
    _pause();
  }

The StakedEXA.sol#_update() function is responsible for managing updates during token transfers (such as deposit/mint and withdraw/redeem). However, it is restricted by the whenNotPaused modifier:

function _update(address from, address to, uint256 amount) internal override whenNotPaused {

Consequently, during emergencies, the withdraw/redeem functions fail, preventing users from accessing their assets. This limitation may hinder timely withdrawals in critical situations, potentially leading to financial losses.

This issue aligns with the concerns outlined in SOLODIT's Checklist:

SOL-CR-1: Users must be able to manage their existing positions regardless of the protocol's status. For instance, users should be able to repay debts even if the protocol is paused, and the protocol should not accumulate debts during a pause.
SOL-CR-2: Certain functionalities must remain operational even when the protocol is paused. For example, users should still be able to withdraw (or repay) assets during a protocol pause.

Impact

Users may be unable to withdraw assets in a timely manner during emergencies, which could lead to potential financial losses.

Code Snippet

Tool used

Manual Review

Recommendation

It is advisable to adjust the StakedEXA.sol#_update() function as follows:

---     function _update(address from, address to, uint256 amount) internal override whenNotPaused {
+++     function _update(address from, address to, uint256 amount) internal override {

Duplicate of #57

sherlock-audit / 2024-07-exactly-stacking-contracts-judging

0xBugHunter - In Emergency Situations, Users are Unable to Withdraw Their Assets (stEXA) #101