User exit/claim methods should not have a whenNotPaused modifier

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L259

Vulnerability details

Summary

The getRewards() function here https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L259 allows users to claim reward, but a call has been made to the mint function at https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/rate-limits/RateLimitedMinter.sol#L49 which has whenNotPaused modifier . This will denied user from getting rewards. This opens up an attack vector, where the protocol owner can decide if the users are able to withdraw/claim any funds from it.

This is a common centralization problem which means the contract owner can "rug" users.

Proof of Concept

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L259

Tools Used

manual code review

Impact

user funds can be left stuck in the contract
funds can stay forever if a Governor or Guardian renounce ownership or compromised (The multiSig) will leave the funds there forever

Recommended Mitigation Steps

Remove the whenNotPaused modifier from mint function or implement a way where user can claim reward without minting them(pre-mint), so users can claim vested tokens even if admin pauses the contract.

Assessed type

Access Control

[0xSorryNotSorry]

inflated, since the Governor role is trusted

[c4-pre-sort]

0xSorryNotSorry marked the issue as insufficient quality report

[c4-judge]

Trumpero marked the issue as unsatisfactory:
Invalid

[Trumpero]

After reviewing again, I believe this is a dup of #1249.

[c4-judge]

Trumpero marked the issue as duplicate of #1249

[Trumpero]

Give this issue 75% partial credit due to its lack of quality

[c4-judge]

Trumpero marked the issue as partial-75