Core interactions would still be accessible after protocol pause

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-10-loopfi/blob/d219f0132005b00a68f505edc22b34f9a8b49766/src/CDPVault.sol#L198
https://github.com/code-423n4/2024-10-loopfi/blob/d219f0132005b00a68f505edc22b34f9a8b49766/src/CDPVault.sol#L240-L304

Vulnerability details

Proof of Concept

By design it is expected that when the CDPVault.sol contract is paused by the Dao, core functionalities like the deposits and withdrawals should no longer be accessible.

Which is one of the reasons why the pauser role is granted to begin with in the constructor: https://github.com/code-423n4/2024-10-loopfi/blob/d219f0132005b00a68f505edc22b34f9a8b49766/src/CDPVault.sol#L198

        _grantRole(PAUSER_ROLE, config.pauseAdmin);

Issue however is that the core functionalities like deposit all lack the whenNotPaused modifier which then means that even if the protocol gets paused, users can still integrate the vault, see https://github.com/code-423n4/2024-10-loopfi/blob/d219f0132005b00a68f505edc22b34f9a8b49766/src/CDPVault.sol#L240-L304

    function deposit(address to, uint256 amount) external returns (uint256 tokenAmount) {
        tokenAmount = wdiv(amount, tokenScale);
        int256 deltaCollateral = toInt256(tokenAmount);
        modifyCollateralAndDebt({
            owner: to,
            collateralizer: msg.sender,
            creditor: msg.sender,
            deltaCollateral: deltaCollateral,
            deltaDebt: 0
        });
    }

    function withdraw(address to, uint256 amount) external returns (uint256 tokenAmount) {
        tokenAmount = wdiv(amount, tokenScale);
        int256 deltaCollateral = -toInt256(tokenAmount);
        modifyCollateralAndDebt({
            owner: to,
            collateralizer: msg.sender,
            creditor: msg.sender,
            deltaCollateral: deltaCollateral,
            deltaDebt: 0
        });
    }

    function borrow(address borrower, address position, uint256 amount) external returns (int256 deltaDebt) {
        uint256 scaledAmount = wdiv(amount, poolUnderlyingScale);
        deltaDebt = toInt256(scaledAmount);
        modifyCollateralAndDebt({
            owner: position,
            collateralizer: position,
            creditor: borrower,
            deltaCollateral: 0,
            deltaDebt: deltaDebt
        });

        return deltaDebt;
    }

    function repay(address borrower, address position, uint256 amount) external returns (int256 deltaDebt){
        uint256 scaledAmount = wdiv(amount, poolUnderlyingScale);
        deltaDebt = -toInt256(scaledAmount);
        modifyCollateralAndDebt({
            owner: position,
            collateralizer: position,
            creditor: borrower,
            deltaCollateral: 0,
            deltaDebt: deltaDebt
        });

        return deltaDebt;
    }

Also this seems to be a change to sort this issue out from the previous scope, however instead of implementing the suggested changes of applying the pausable modifier to the internal function being called it's not being done and instead no protection can be provided once the protocol is paused.

Impact

Pausing functionality is broken, users can still deposit. withdraw, borrow, repay even if protocol is paused due to say a blackswan event or whatsoever.

Recommended Mitigation Steps

Attach the whenNotPaused modifier to all 4 of deposit. withdraw, borrow, repay.

Assessed type

Context