dimah7 - Super pools can't be paused, in case of an emergency

[sherlock-admin4]

dimah7

Medium

Super pools can't be paused, in case of an emergency

Summary

Super pools functions can't be paused, in case of an emergency

Vulnerability Detail

As can be seen in SuperPool.sol, there is a pausing/unpausing function implemented, with the idea to freeze the functionality:

/// @notice Toggle pause state of the SuperPool
    function togglePause() external onlyOwner {
        if (Pausable.paused()) Pausable._unpause();
        else Pausable._pause();
    }

The problem is that this logic is inefficient. Based on OZ's Pausable.sol code a whenNotPaused modifier is required in order to freeze the functions successfully when the pool is in paused state:

OZ::Pausable.sol:

 modifier whenNotPaused() {
        _requireNotPaused();
        _;
    }


function _requireNotPaused() internal view virtual {
        if (paused()) {
            revert EnforcedPause();
        }
    }

For example the correct logic is implemented in the PositionManager contract, but lacks in the super pool:

                                                                                 !!!!!!!!!!!!!
function process(address position, Action calldata action) external nonReentrant whenNotPaused {
        _process(position, action);
        if (!riskEngine.isPositionHealthy(position)) revert PositionManager_HealthCheckFailed(position);
    }

Impact

• Impact: High, in case of an emergency the admin can't freeze the protocol. The worst outcome would be funds to be stolen
• Likelihood: Low, as it requires a breach in the protocol's code to happen
• Overall: Medium

Code Snippet

https://github.com/sherlock-audit/2024-08-sentiment-v2/blob/0b472f4bffdb2c7432a5d21f1636139cc01561a5/protocol-v2/src/SuperPool.sol#L20
https://github.com/sherlock-audit/2024-08-sentiment-v2/blob/0b472f4bffdb2c7432a5d21f1636139cc01561a5/protocol-v2/src/SuperPool.sol#L164-L167

Tool used

Manual Review

Recommendation

Add the whenNotPaused modifier where necessary

Duplicate of #270