Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Emergency Withdraw Delay counted twice

TheKhans

Summary

The emergencyWithdraw function imposes a 6-day delay instead of the intended 3-day delay due to the combined effects of scheduling and enabling the action.

Vulnerability Details

The emergency withdrawal process consists of three steps:
First the owner calls scheduleEmergencyAction, which sets the _emergencyTimelock timestamp for the given action. which can be seen from below code:

/contracts/core/tokens/veRAACToken.sol:340
340: function scheduleEmergencyAction(bytes32 actionId) external onlyOwner {
341: _emergencyTimelock[actionId] = block.timestamp;
342: emit EmergencyActionScheduled(actionId, block.timestamp + EMERGENCY_DELAY);
343: }
​

Second The owner then calls enableEmergencyWithdraw, which checks if 3 days have passed (withEmergencyDelay modifier) before setting the emergencyWithdrawDelay to another 3-day delay.

/scontracts/core/tokens/veRAACToken.sol:359
359: function enableEmergencyWithdraw() external onlyOwner withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) {
360: emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY;
361: emit EmergencyWithdrawEnabled(emergencyWithdrawDelay);
362: }

If we look the modifier code, we can see that the timestamp that we set in _emergencyTimelock mapping is checked over here.

/contracts/core/tokens/veRAACToken.sol:161
161: modifier withEmergencyDelay(bytes32 actionId) {
162: uint256 scheduleTime = _emergencyTimelock[actionId];
163: if (scheduleTime == 0) revert EmergencyActionNotScheduled();
164: if (block.timestamp < scheduleTime + EMERGENCY_DELAY) revert EmergencyDelayNotMet();
165: _;
166: delete _emergencyTimelock[actionId];
167: }

Third The owner can only call emergencyWithdraw after emergencyWithdrawDelay has elapsed.

/contracts/core/tokens/veRAACToken.sol:368
368: function emergencyWithdraw() external nonReentrant {
369: if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
370: revert EmergencyWithdrawNotEnabled();
371:

Instead of enforcing a 3-day delay, the contract imposes a 6-day delay (3 days to enable + 3 days to withdraw).

Impact

The user must wait 6 days instead of the intended 3 days for an emergency withdrawal.

Tools Used

Manual Review

Recommendations

Modify the logic so that the emergency withdrawal delay is correctly enforced as 3 days instead of 6 days.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken implements two consecutive 3-day emergency delays (totaling 6 days), hindering timely emergency response when funds need to be withdrawn quickly

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!