Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`TimelockController::executeEmergencyAction` doesn't impose `EMERGENCY_DELAY`.

tdey

Vulnerability details:

The TimelockController contract mentions, EMERGENCY_DELAY for executing emergency actions.

/// @notice Delay for emergency actions (1 day)
uint256 public constant EMERGENCY_DELAY = 1 days;

The executeEmergencyAction() function doesn't impose this delay. Allows emergency executors to bypass the timelock mechanism entirely, defeating the purpose of the delay for emergency actions.

Impact

Enables emergency executors to execute actions without adhering to the delay mechanism.

Reccomended mitigation

Below is a detailed description on how to implement this check :

1.Introduce a new state variable to keep track of emergency scheduling timestamp :

uint256 private _emergencyScheduledTimestamp

2.Update the variable in scheduleEmergencyAction() function:

function scheduleEmergencyAction(bytes32 id) external onlyRole(EMERGENCY_ROLE) {
_emergencyActions[id] = true;
+++ _emergencyScheduledTimestamp = block.timestamp;
emit EmergencyActionScheduled(id, block.timestamp);
}

3.Check in executeEmergencyAction() function to see if the delay time has passed or not:

require(block.timestamp > scheduledTimestamp + EMERGENCY_DELAY,"Emergency delay not passed!");
function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
+++ require(block.timestamp > scheduledTimestamp + EMERGENCY_DELAY,"Emergency delay not passed!");
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
...//remaining function
}

In this way we can keep a track of when the emergency actions are scheduled and verify if the delay for emergency actions have passed.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!