Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The execution delay of `veRAACToken::enableEmergencyWithdraw()` is longer than expected.

joicygiore

Summary

The execution delay of veRAACToken::enableEmergencyWithdraw() is longer than expected.

Vulnerability Details

The enableEmergencyWithdraw() function is designed to enable emergency withdrawals. However, it applies the withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) modifier, which first verifies whether EMERGENCY_DELAY has elapsed and then updates emergencyWithdrawDelay. This results in an additional calculation of EMERGENCY_DELAY, causing the total delay to be EMERGENCY_DELAY * 2, which is inconsistent with the intended functionality as described in the documentation.

// veRAACToken::enableEmergencyWithdraw()
function enableEmergencyWithdraw() external onlyOwner withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) {
@> emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY;
emit EmergencyWithdrawEnabled(emergencyWithdrawDelay);
}
modifier withEmergencyDelay(bytes32 actionId) {
uint256 scheduleTime = _emergencyTimelock[actionId];
if (scheduleTime == 0) revert EmergencyActionNotScheduled();
@> if (block.timestamp < scheduleTime + EMERGENCY_DELAY) revert EmergencyDelayNotMet();
_;
delete _emergencyTimelock[actionId];
}
function scheduleEmergencyAction(bytes32 actionId) external onlyOwner {
@> _emergencyTimelock[actionId] = block.timestamp;
emit EmergencyActionScheduled(actionId, block.timestamp + EMERGENCY_DELAY);
}

In contrast, the executeEmergencyUnlock() function only enforces a single EMERGENCY_DELAY, aligning with expected behavior:

function scheduleEmergencyUnlock() external onlyOwner {
_emergencyTimelock[EMERGENCY_UNLOCK_ACTION] = block.timestamp;
emit EmergencyUnlockScheduled();
}
​
function executeEmergencyUnlock() external onlyOwner withEmergencyDelay(EMERGENCY_UNLOCK_ACTION) {
emergencyUnlockEnabled = true;
emit EmergencyUnlockEnabled();
}

Impact

The enableEmergencyWithdraw() function applies a delay of EMERGENCY_DELAY * 2, which deviates from the expected behavior and could lead to unexpected delays in emergency withdrawal execution.

Tools Used

Manual Review

Recommendations

Modify the implementation of enableEmergencyWithdraw() to ensure that the delay is correctly set to EMERGENCY_DELAY instead of EMERGENCY_DELAY * 2.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken implements two consecutive 3-day emergency delays (totaling 6 days), hindering timely emergency response when funds need to be withdrawn quickly

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!