Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Predecessor Check in `executeEmergencyAction()` function

maglov

Summary

The executeEmergencyAction function does not check if a predecessor operation (if specified) has been executed. This allows emergency actions to bypass dependency requirements, potentially leading to out-of-order execution and protocol inconsistencies.

Vulnerability Details

The executeEmergencyAction function accepts a predecessor parameter but does not enforce its execution before proceeding. This is inconsistent with the behavior of executeBatch, which explicitly checks the predecessor's status.

Impact

  • Out-of-Order Execution: Emergency actions could be executed before their dependencies, violating the intended operation flow.

  • Protocol Inconsistencies: This could lead to unexpected state changes or protocol instability.

  • Loss of Funds: If an emergency action depends on a prior operation (e.g., fund allocation), bypassing the dependency could result in financial losses.

Tools Used

Manual Review

Recommendations

Add a predecessor check in executeEmergencyAction to ensure that the specified predecessor operation has been executed before proceeding. This check should mirror the behavior in executeBatch.

function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
// Add predecessor check
if (predecessor != bytes32(0)) {
if (!isOperationDone(predecessor)) {
revert PredecessorNotExecuted(predecessor);
}
}
delete _emergencyActions[id];
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
revert CallReverted(id, i);
}
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController::executeEmergencyAction accepts predecessor parameter but unlike executeBatch doesn't verify it's executed, breaking operation sequencing in emergencies

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.