Core Contracts

Description

In TimelockController::executeEmergencyAction, the nonReentrant modifier is placed after the onlyRole modifier. This ordering could allow a malicious actor with the EMERGENCY_ROLE to perform a reentrancy attack during the role check, before the reentrancy guard is activated.

The issue arises because:

1. onlyRole check executes first

2. During this check, the contract state is unprotected from reentrancy

3. The nonReentrant guard only activates after role verification

Impact

1. Reentrancy Window: Creates a small window where reentrancy is possible during role checking

2. State Manipulation: An attacker with EMERGENCY_ROLE could potentially:

   • Re-enter the contract during role verification

   • Manipulate contract state before reentrancy guard activates

   • Execute emergency actions multiple times in a single transaction

3. Critical Severity: Given this is an emergency action function, any vulnerability could have severe consequences

4. Privileged Attack Vector: While this requires EMERGENCY_ROLE access, it still represents a significant risk

Recommendations

Correct Modifier Order