Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Predecessor Check in `executeEmergencyAction()` function

maglov

Summary

The executeEmergencyAction function does not check if a predecessor operation (if specified) has been executed. This allows emergency actions to bypass dependency requirements, potentially leading to out-of-order execution and protocol inconsistencies.

Vulnerability Details

The executeEmergencyAction function accepts a predecessor parameter but does not enforce its execution before proceeding. This is inconsistent with the behavior of executeBatch, which explicitly checks the predecessor's status.

Impact

  • Out-of-Order Execution: Emergency actions could be executed before their dependencies, violating the intended operation flow.

  • Protocol Inconsistencies: This could lead to unexpected state changes or protocol instability.

  • Loss of Funds: If an emergency action depends on a prior operation (e.g., fund allocation), bypassing the dependency could result in financial losses.

Tools Used

Manual Review

Recommendations

Add a predecessor check in executeEmergencyAction to ensure that the specified predecessor operation has been executed before proceeding. This check should mirror the behavior in executeBatch.

function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
// Add predecessor check
if (predecessor != bytes32(0)) {
if (!isOperationDone(predecessor)) {
revert PredecessorNotExecuted(predecessor);
}
}
delete _emergencyActions[id];
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
revert CallReverted(id, i);
}
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController::executeEmergencyAction accepts predecessor parameter but unlike executeBatch doesn't verify it's executed, breaking operation sequencing in emergencies

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!