redeem() should be possible when protocol is Paused but to be able to redeem function grantRTokenAllowance() should be called for any basket tokens and it can only be called when protocol is not paused

Lines of code Vulnerability details Impact Function redeem in RToken contract, redeems RToken for basket collateral and it's callable when protocol is paused. but function redeem transfers basket tokens from BackingManager contract to redeemer and it requires spending allowance of the BackingMang...

exchangeRateDeltaLimit can be exceeded with overrideExchangeRate() and remain unpaused

Lines of code Vulnerability details Impact The CashManger has a safety feature that limits the maximum change in the exchange rate between epochs. in setMintExchangeRate it is checked that this limit is not exceeded but there is no check in overrideExchangeRate. Proof of Concept An epoch could ha...