Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

EMERGENCY_ADMIN cannot adequately fulfill emergency responsibilities

tigerfrake

Summary

The protocol implements the EMERGENCY_ADMIN and EMERGENCY_ROLE to perform emergency duties. However, the EMERGENCY_ADMIN in BaseGauge is blocked form performing Emergency withdrawal of tokens as required.

Vulnerability Details

In FeeCollector, the following is provided:

// - EMERGENCY_ROLE: Can pause contract and execute emergency functions
bytes32 public constant EMERGENCY_ROLE = keccak256("EMERGENCY_ROLE");

As such, this role is able to perform emergency withdrawal of tokesn as stated above:

function emergencyWithdraw(address token) external override whenPaused {
>> if (!hasRole(EMERGENCY_ROLE, msg.sender)) revert UnauthorizedCaller();
---SNIP---
​
emit EmergencyWithdrawal(token, balance);
}

Now, in BaseGauge, the EMERGENCY_ADMIN is implemented with the following comment:

>> // @notice Role for emergency admin functions
bytes32 public constant EMERGENCY_ADMIN = keccak256("EMERGENCY_ADMIN");

However, notice that this role is blocked here in emergencyWithdraw():

>> function emergencyWithdraw(address token, uint256 amount) external onlyRole(DEFAULT_ADMIN_ROLE) {
// @audit-issue Emergency admin is blocked from operation
IERC20(token).safeTransfer(msg.sender, amount);
}

This function requires the caller to have the DEFAULT_ADMIN_ROLE. It is true that such an admin can manage the EMERGENCY_ADMIN role but this does not mean that another user who has been granted the EMERGENCY_ADMIN will be able to perform this operation.

Impact

The EMERGENCY_ADMIN is blocked from performing emergency withdrawal of tokens as required which goes against the administartion model intended by the protocol.

Tools Used

Manual Review

Recommendations

Modify the emergencyWithdraw() to use EMERGENCY_ADMIN:

- function emergencyWithdraw(address token, uint256 amount) external onlyRole(DEFAULT_ADMIN_ROLE) {
+ function emergencyWithdraw(address token, uint256 amount) external onlyRole(EMERGENCY_ADMIN) {
IERC20(token).safeTransfer(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::emergencyWithdraw restricts access to DEFAULT_ADMIN_ROLE instead of EMERGENCY_ADMIN, breaking the intended permission model for emergency operations

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::emergencyWithdraw restricts access to DEFAULT_ADMIN_ROLE instead of EMERGENCY_ADMIN, breaking the intended permission model for emergency operations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.