Submitted by HollaDieWaldfee, also found by aviggiano
The TokenggAVAX contract (https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/tokens/TokenggAVAX.sol#L24) can be paused.
The whenTokenNotPaused modifier is applied to the following functions (https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/tokens/TokenggAVAX.sol#L225-L239):
previewDeposit, previewMint, previewWithdraw and previewRedeem
Thereby any calls to functions that deposit or withdraw funds revert.
There are two functions (maxWithdraw and maxRedeem) that calculate the max amount that can be withdrawn or redeemed respectively.
Both functions return 0 if the TokenggAVAX contract is paused.
The issue is that TokenggAVAX does not override the maxDeposit and maxMint functions (https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/tokens/upgradeable/ERC4626Upgradeable.sol#L156-L162) in the ERC4626Upgradable contract like it does for maxWithdraw and maxRedeem.
Thereby these two functions return a value that cannot actually be deposited or minted.
This can cause any components that rely on any of these functions to return a correct value to malfunction.
So maxDeposit and maxMint should return the value 0 when TokenggAVAX is paused.
VSCode
The maxDeposit and maxMint functions should be overridden by TokenggAVAX just like maxWithdraw and maxRedeem are overridden and return 0 when the contract is paused (https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/tokens/TokenggAVAX.sol#L206-L223).
So add these two functions to the TokenggAVAX contract:
Alex the Entreprenerd (judge) commented:
0xju1ie (GoGoPool) disagreed with severity and commented:
emersoncloud (GoGoPool) commented:
Alex the Entreprenerd (judge) decreased severity to Low and commented:
Alex the Entreprenerd (judge) increased severity to Medium and commented:
emersoncloud (GoGoPool) mitigated:
Status: Mitigation confirmed by RaymondFam and hansfriese.
