Submission Details
Severity:
TimelockController's 'cancel' function throws misleading error when cancel is called on an executed proposal
Vulnerability Details
`ITimelockController` interface contains error messages for each specific situation.
For example
/// @notice Thrown when operation is already scheduled
error OperationAlreadyScheduled(bytes32 id);
/// @notice Thrown when operation already executed
error OperationAlreadyExecuted(bytes32 id);
When the 'cancel' function is called on an already executed operation , it is expected to use the
error OperationAlreadyExecuted(bytes32 id);
But currently it reverts with the wrongl OperationAlreadyScheduled(id);error, which is misleading
if (_operations[id].executed) {
revert OperationAlreadyScheduled(id);
}
Recommendations
Revert with the OperationAlreadyExecutederror
if (_operations[id].executed) {
revert OperationAlreadyExecuted(bytes32 id);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.