Core Contracts

Summary

The veRAACToken::enableEmergencyWithdraw function adds an unnecessary second delay period of EMERGENCY_DELAY (3 days) after the initial delay enforced by the veRAACToken::withEmergencyDelay modifier. This results in a total delay of 6 days instead of the intended 3 days, violating the protocol’s emergency response design and causing user funds to remain locked longer than expected during emergencies.

Vulnerability Details

Code Context:

Explanation:

1. The withEmergencyDelay modifier ensures that enableEmergencyWithdraw can only execute after a 3-day delay from the time the emergency action was scheduled (scheduleTime + EMERGENCY_DELAY).

2. However, the function itself sets emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY, adding another 3-day delay before users can call emergencyWithdraw().

3. This results in a total delay of 6 days (3 days from the modifier + 3 days from the function).

Impact

Severity: High

1. Critical Functionality Failure:

   • The emergency withdrawal mechanism is a core safety feature of the protocol. Misalignment between documented and actual behavior constitutes a critical failure in protocol logic, regardless of who triggers it.

   • Example: If the protocol markets "3-day emergency withdrawals" to users, the double delay breaches trust and contractual expectations.

2. Indirect Financial Impact:

   • Users may incur losses due to market conditions during the extra 3-day delay (e.g., token price collapse, missed opportunities).

   • Example: A user expects to withdraw during a market crash at day 3 but is forced to wait until day 6, resulting in deeper losses.

3. Reputational and Legal Risks:

   • Misleading functionality could lead to regulatory scrutiny (e.g., false advertising claims) or mass user exits due to distrust.

Tools Used

• Manual code review.

Recommendations

Fix: Remove the redundant delay in enableEmergencyWithdraw:

Verification:
Ensure the total delay for emergency withdrawals is exactly EMERGENCY_DELAY (3 days) from the time the action is scheduled, not doubled.