Era
ZKsync
FoundryLayer 2
500,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of deadline for security council or guardian-approved upgrade proposals

bladesec

Summary

Upgrade proposals approved by the security council or guardians remain valid indefinitely and can be executed at any point after the delay period. This poses a risk if the proposal becomes outdated or irrelevant over time.

Vulnerability Details

As per upgradeState function in ProtocolUpgradeHandler contract,
proposals approved by security council are valid since upg.securityCouncilApprovalTimestamp + UPGRADE_DELAY_PERIOD and proposals approved by gurdians are valid since upg.creationTimestamp + legalVetoTime + UPGRADE_WAIT_OR_EXPIRE_PERIOD + UPGRADE_DELAY_PERIOD.

function upgradeState(bytes32 _id) public view returns (UpgradeState) {
...
// Security council approval case
if (upg.securityCouncilApprovalTimestamp != 0) {
>> uint256 readyWithSecurityCouncilTimestamp = upg.securityCouncilApprovalTimestamp + UPGRADE_DELAY_PERIOD;
return block.timestamp >= readyWithSecurityCouncilTimestamp
? UpgradeState.Ready
: UpgradeState.ExecutionPending;
}
​
uint256 waitOrExpiryTimestamp = upg.creationTimestamp + legalVetoTime + UPGRADE_WAIT_OR_EXPIRE_PERIOD;
if (block.timestamp >= waitOrExpiryTimestamp) {
if (!upg.guardiansApproval) {
return UpgradeState.Expired;
}
​
>> uint256 readyWithGuardiansTimestamp = waitOrExpiryTimestamp + UPGRADE_DELAY_PERIOD;
return block.timestamp >= readyWithGuardiansTimestamp ? UpgradeState.Ready : UpgradeState.ExecutionPending;
}
​
return UpgradeState.Waiting;
}

In other words, these proposals remain valid indefinitely after a certain time and do not expire. While this is generally not an issue, it could lead to problems if the proposals become significantly outdated.

Impact

Proposals with indefinite validity could lead to issues and cause unexpected behavior during protocol upgrades.

Tools Used

Manual Review

Recommendations

Establish a specific deadline and enforce restrictions on the valid execution period for these proposals.

Updates

Lead Judging Commences

inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] Informational

Admin input validation, gas, missing events not related to bridges, NATSPEC, spellcheck, Address Zero, Indexed fields in Events, 0 impact, trusted admin/party action https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Appeal created

inallhonesty Lead Judge
5 months ago
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of proposal expiry mechanisms can lead to governance exploits.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.