audit: dont allow unpause if rate is stale (#414)

Author: keyleu

solidity/src/vaults/OneWayVault.sol

@@ -515,6 +515,13 @@ contract OneWayVault is
         if (_vaultState.pausedByStaleRate && msg.sender != owner()) {
             revert("Only owner can unpause if paused by stale rate");
         }
+        if (
+            _vaultState.pausedByStaleRate
+                && uint64(block.timestamp) - lastRateUpdateTimestamp > config.maxRateUpdateDelay
+        ) {
+            revert("Cannot unpause while rate is stale");
+        }
+
         delete vaultState;
         emit PausedStateChanged(false);
     }

solidity/test/vaults/OneWayVault.t.sol

@@ -680,6 +680,11 @@ contract OneWayVaultTest is Test {
         vm.expectRevert("Only owner can unpause if paused by stale rate");
         vault.unpause();
 
+        // If no update has happened, even owner can't unpause
+        vm.prank(owner);
+        vm.expectRevert("Cannot unpause while rate is stale");
+        vault.unpause();
+
         // Update the rate so that owner can unpause and users can deposit again
         uint256 newRate = initialRate * 2; // Double the rate
         vm.prank(strategist);