Skip to content
low Best Practice No SWC entry CWE-703

Critical Entrypoints Not Pausable

SAFE-0254 Best Practice Checked automatically by the scanner
1

What goes wrong

The contract defines a pause mechanism but critical value-moving functions (deposit/withdraw/swap) are missing the whenNotPaused modifier, so pausing does not actually stop the flow that matters during an incident.

2

The vulnerable pattern

proof of concept — how it is exploited
// team pauses during an exploit, but withdraw() lacks whenNotPaused
// -> the attacker keeps withdrawing while everything else is frozen.
3

How to fix it

the pattern that is safe
function withdraw(uint256 a) external whenNotPaused nonReentrant { ... }
Apply whenNotPaused to all critical entrypoints.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0254 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs