Summary

The TimelockController contract allows for the scheduling and execution of batch operations with a configurable delay. However, the contract does not impose any restrictions or checks to prevent transactions from exceeding the Ethereum gas limit, which can lead to failures when large batches of operations are scheduled and executed.

Vulnerability Details

The TimelockController contract allows users to schedule operations in batches via the scheduleBatch and executeBatch functions. Each batch consists of multiple target addresses, values, and calldata items. The total gas cost for executing these batches depends on the number of operations in the batch and the complexity of the calldata provided.

Ethereum transactions are subject to a gas limit, and a large batch may exceed the gas limit of a block, causing the transaction to fail. This can be problematic if the system does not enforce a limit on the batch size, allowing users to schedule operations that could be computationally expensive and fail at execution.

Impact

Transaction Failure: Large batches that exceed the gas limit will fail, causing the entire operation to be reverted. This may lead to operational disruptions, especially if critical governance or protocol updates are included in the failed batch.

Denial-of-Service (DoS): Attackers or malicious actors could potentially schedule excessively large batches of operations to deliberately cause failures, rendering the timelock system unusable for legitimate governance actions.

Resource Wastage: If large batches are not detected and limited, it could lead to wasted computational resources as miners or validators spend gas on failed transactions, increasing the overall network load.

Tools Used

aderyn

Recommendations

Implement Batch Size Limitations:

Introduce a maximum batch size (e.g., MAX_BATCH_SIZE) to ensure that the number of operations in a batch is capped. This would prevent users from creating overly large batches that could potentially exceed the gas limit.