Core Contracts

Summary

The veRAACToken contract has an emergency withdrawal feature that allows the contract owner to enable emergency withdrawals. In this contract, you can schedule and cancel emergency actions using the scheduleEmergencyAction and cancelEmergencyAction functions. However once the emergency withdrawal mode is enabled, there is no mechanism to disable or revoke this state. This limitation creates a situation where the contract can permanently allow emergency withdrawals, potentially leading to undesirable outcomes such as unauthorized fund withdrawals or loss of control over emergency processes.

Vulnerability Details

1. Functionality:

   • The contract implements the enableEmergencyWithdraw() function, which enables emergency withdrawals.

   • Once emergency withdrawal mode is enabled, it sets a delay (emergencyWithdrawDelay), allowing users to withdraw their tokens in an emergency scenario.

2. Absence of Disable Mechanism:

   • After activation, the emergency withdrawal mode cannot be disabled or reversed. The contract does not provide a function or mechanism for deactivating the emergency withdrawal state once enabled.

3. Unintended Consequences:

   • There is no safeguard or administrative functionality to turn off the emergency withdrawal mode if it's triggered by mistake or if the emergency has passed.

Impact

1. Permanent Exposure to Emergency Withdrawals:

   • Once the emergency withdrawal mode is enabled, users can withdraw funds even if there is no real emergency, potentially causing a loss of liquidity or destabilizing the contract’s functionality.

2. Loss of Control:

   • The contract owner or administrator cannot revoke the emergency withdrawal status, leading to a potential loss of control over the withdrawal functionality. This may result in users withdrawing funds for non-emergency reasons.

3. Security Concerns:

   • Keeping emergency withdrawal mode permanently active increases the attack surface, as malicious actors or unintentional actions may exploit the feature.

Tools Used

Manual Code Review

Recommendations

Create a function that allows the owner to reset the emergencyWithdrawDelay to 0.