Skip to content

Latest commit

 

History

History
42 lines (23 loc) · 1.63 KB

023.md

File metadata and controls

42 lines (23 loc) · 1.63 KB
Raw

Bright Pecan Eagle

Medium

The investments that are being processed for the time being aren't paused, even if the setInvestmentIsPaused function is called.

Summary

If a admin calls setInvestmentIsPaused to pause investments and then immediately calls invest in a new transaction, the invest function will check the state of investmentIsPaused at the time it is executed. If the state was changed to true before the invest call was executed, the investment will be paused. However, if the invest call is executed before the state change takes effect, it will proceed. Also, If setInvestmentIsPaused is called in a separate transaction after an invest call has already been initiated, it will not affect that ongoing transaction.

Root Cause

In case it weakens the admin's authority. The admin must be able to pause all investments, even if they are currently being processed.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. The invest function is called.
  2. The setInvestmentIsPaused function is called before the invest function has finished, but after the investmentIsPaused condition is passed.

The investment that is being processed wasn't paused.

Impact

No response

PoC

No response

Mitigation

  1. Duplicate if (investmentIsPaused) revert InvestmentPaused(); line on [(https://github.com/sherlock-audit/2024-11-vvv-exchange-update/blob/main/vvv-platform-smart-contracts/contracts/vc/VVVVCInvestmentLedger.sol#L143)] to the end of revert function.
  2. Or use re-entrency modifier for invest function and setInvestmentIsPaused function.