003.md

XDZIBEC

medium

XDZIBEC- Unauthorized Contract Pausing in Pausable Contract

Summary

The _pause() function in Contract has a vulnerability that allows any account to pause the contract, even if they are not authorized. This can lead to a disruption in the contract's functionality and prevent legitimate users from interacting with it.

Vulnerability Detail

there is a vulnerability in _pause() function:

    function _pause() internal virtual whenNotPaused {
        _paused = true;
        emit Paused(_msgSender());
    }

    /**
     * @dev Returns to normal state.
     *
     * Requirements:
     *
     * - The contract must be paused.
     */
    function _unpause() internal virtual whenPaused {
        _paused = false;
        emit Unpaused(_msgSender());
    }
}

the function _pause() does not check if the caller is an authorized account. This means that any account could pause the contract, even if they are not authorized to do so. This allow an attacker to prevent users from interacting with the contract.

Impact

the bug in _pause() function could be exploited by an attacker can lead to disrupt the functionality of the contract and prevent users from interacting with it.

Code Snippet

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/09329f8a18f08df65863a5060f6e776bf7fccacf/contracts/security/Pausable.sol#L89

Tool used

Manual Review

Recommendation

modify the_pause() function to include a check that only authorized accounts can pause the contract. This can be achieved by implementing access control mechanisms, such as utilizing the Ownable contract from OpenZeppelin or implementing a custom access control solution. By implementing proper access controls, the contract can ensure that only authorized accounts have the ability to pause or unpause the contract, maintaining the integrity and usability of the system.