cancel METHOD CAN BE CALLED EVEN IN PAUSED STATE

[code423n4]

Lines of code

https://github.com/reserve-protocol/protocol/blob/df7ecadc2bae74244ace5e8b39e94bc992903158/contracts/p1/RToken.sol#L406

Vulnerability details

Description

According to reserve.org Docs, It is clearly stated here that whenever a Paused state has been called, the action of Cancelling RToken issuance should be Disabled.

Impact

The Action of cancelling the RToken can be taken even in paused state.

Proof of Concept

File: p1/RToken.sol

406:      function cancel(uint256 endId, bool earliest) external notFrozen {

Link to Code

Here the cancel method has used notFrozen modifier. But has no access control for paused state.

Tools Used

Manual Review

Recommended Mitigation Steps

Change the modifier from notFrozen to notPausedOrFrozen

[c4-judge]

0xean marked the issue as primary issue

[c4-judge]

0xean marked the issue as duplicate of #470

[c4-judge]

Duplicate of #456