Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Non-functional Emergency Unlock Implementation in veRAACToken contract

lamsy

Summary

The veRAACToken contract contains a dormant emergency unlock system that includes state variables, scheduling functions, and execution logic, but lacks any actual unlocking functionality. While the contract implements a complete two-step process for enabling emergency unlocks (scheduling scheduleEmergencyUnlock and execution executeEmergencyUnlock with time delay), the emergencyUnlockEnabled state variable is never referenced or utilized in any other contract functions.

Vulnerability Details

The contract implements emergency unlock functions that have no effect on the system:

// State variable that's set but never used
bool public emergencyUnlockEnabled;
​
// Functions that modify the unused state
function scheduleEmergencyUnlock() external onlyOwner {
_emergencyTimelock[EMERGENCY_UNLOCK_ACTION] = block.timestamp;
emit EmergencyUnlockScheduled();
}
​
function executeEmergencyUnlock() external onlyOwner withEmergencyDelay(EMERGENCY_UNLOCK_ACTION) {
emergencyUnlockEnabled = true;
emit EmergencyUnlockEnabled();
}

Impact:

  • Admin cannot implement unlock functionality in critical situations

  • wastes gas and storage slot in the contract

Tools Used

Manual review

Recommendations

  1. if the unlock mechanism is not needed remove unused code:

    Remove these elements

    • bool public emergencyUnlockEnabled;

    • bytes32 private constant EMERGENCY_UNLOCK_ACTION

    • function scheduleEmergencyUnlock()

    • function executeEmergencyUnlock()

  2. If emergency unlock is needed, implement complete functionality:

bool public emergencyUnlockEnabled;
function executeEmergencyUnlock() external onlyOwner withEmergencyDelay(EMERGENCY_UNLOCK_ACTION) {
emergencyUnlockEnabled = true;
emit EmergencyUnlockEnabled();
// Implement actual unlock logic
_unlockAllPositions(); // New function to handle unlocks
}
​
function _unlockAllPositions() internal {
// Implementation of mass unlock logic
}
​
function lockAllPositions() public onlyOwner {
// implement the lock logic for safe locking
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::executeEmergencyUnlock is dormant, it configures a system that's never used

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.