<!-- canonical: https://0xsimao.com/findings/cork-protocol-able-pause-deposits-withdrawals -->

# Admin will not be able to only pause deposits in the `Vault` due to incorrect check leading to DoSed withdrawals

Medium · Sherlock · Derivatives · 29th August 2024

Finding M-2 of the Cork Protocol competition.

- Protocol: https://audits.sherlock.xyz/contests/506
- Codebase: https://github.com/0xsimao/2024-08-cork-protocol/tree/db23bf67e45781b00ee6de5f6f23e621af16bd7e
- Source: https://github.com/sherlock-audit/2024-08-cork-protocol-judging/issues/182

---

### Summary

The modifier [LVDepositNotPaused](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/ModuleState.sol#L108) in [Vault::depositLv()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/Vault.sol#L33) checks [states[id].vault.config.isWithdrawalPaused](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/ModuleState.sol#L109) instead of [states[id].vault.config.isDepositPaused](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/State.sol#L107), which means deposits will only be paused if withdrawals are paused, DoSing withdrawals.

### Root Cause

In `ModuleState:109`, it checks `states[id].vault.config.isWithdrawalPaused` when it should check `states[id].vault.config.isDepositPaused`.

### Internal pre-conditions

1. Admin pauses deposits.

### External pre-conditions

None.

### Attack Path

1. Admin sets deposits paused, but deposits are not actually paused due to the incorrect modifier.
2. Admin either leaves deposits unpaused or pauses both deposits and withdrawals, DoSing withdrawals.

### Impact

Admin is not able to pause deposits alone which would lead to loss of funds as this is an emergency mechanism. If the admin wants to pause deposits, withdrawals would also have to be paused, DoSing withdrawals.

### PoC

`ModuleState::LVDepositNotPaused()` is incorrect:
```solidity
modifier LVDepositNotPaused(Id id) {
    if (states[id].vault.config.isWithdrawalPaused) { //@audit isDepositPaused
        revert LVDepositPaused();
    }
    _;
}
```

### Mitigation

`ModuleState::LVDepositNotPaused()` should be:
```solidity
modifier LVDepositNotPaused(Id id) {
    if (states[id].vault.config.isDepositPaused) {
        revert LVDepositPaused();
    }
    _;
}
```

---

Related findings:

- [`ManagedLeveragedVault::executeWithdrawalEpoch()` incorrect ICR and DoSed withdrawals due to not accouting for fees](https://0xsimao.com/findings/beraborrow-i-withdrawal-epoch-withdrawals-fees): Beraborrow Managed Dens
- [DoSed withdrawals due to `ManagedLeveragedVault::executeWithdrawalEpoch()` repaying debt above limit](https://0xsimao.com/findings/beraborrow-i-withdrawals-withdrawal-epoch-debt): Beraborrow Managed Dens
- [Utilization rates are 0 when average assets are 0, which may be used to game maturity borrows / deposits / withdrawals](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-average-borrows-deposits-withdrawals): Exactly Protocol Update - Staking Contract
- [Withdrawals can fail due to deposits reverting in `completeQueuedWithdrawal()`](https://0xsimao.com/findings/renzo-withdrawals-deposits-complete-withdrawal): Renzo