F-2025-0005·missing-emergency-controls

Missing pause / unpause functions prevents emergency protocol shutdown

Fixedstakingnft-boostrewards
TL;DR

Contract inherits PausableUpgradeable and initialises pausable state but never exposes pause / unpause functions, so the team cannot halt staking during a discovered exploit.

Severity
MEDIUM
Impact
MEDIUM
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

This issue was found during the mitigation period as part of the recommended mitigation for F-2025-0004 (the max reward allocation finding).

The contract inherits from PausableUpgradeable but does not implement the necessary functions to utilise this functionality. The contract initialises the pausable functionality with __Pausable_init() but does not expose any functions to actually pause or unpause the contract.

03Section · Impact

Impact

If a critical vulnerability is discovered or if the contract needs to be temporarily halted for any reason:

  1. The team cannot pause the contract to prevent further exploitation.
  2. Users can continue interacting with a potentially vulnerable contract.
  3. The emergency mitigation mechanism is completely non-functional.

This is particularly concerning as the pause functionality was meant to be a safety mechanism for emergency situations.

04Section · Recommendation

Recommendation

Add pause and unpause functions:

solidity
/**
* @notice Pauses the contract, preventing staking and unstaking
* @dev Only callable by owner
*/
function pause() public onlyOwner {
_pause();
}
/**
* @notice Unpauses the contract, allowing staking and unstaking
* @dev Only callable by owner
*/
function unpause() public onlyOwner {
_unpause();
}
05Section · Resolution

Resolution

Ample Protocol: Fixed.

Zealynx: Verified.

Status
Fixed
F-2025-0005

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx