Submitted by LowK, also found by HHK, Tendency, ItsNio, ak1, and Inspecktor
When the admin pauses the contract RdpxV3core locks anyone to use this contract such as a bond, bondWithDelegate, and withdraw. But a function redeem is still available to use.
Any situations that occur like a hack accident or system are under maintenance then anyway, your smart contract is running to continue to get unexpected.
The code below does not call a function whenNotPause() to check whether this contract is paused or not.
To reproduce this vulnerability, lets modify a test called testRedeem() in a /test/rdpxV2-core/Unit.t.sol. After running the test, you will get everything passed. So it is proof of vulnerable
Adding the line _whenNotPaused(); into the function redeem().
psytama (Dopex) confirmed
