Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

In TimeLock most of the functions are not checking if there are enough msg.value sent by the user

ChainDefenders

Summary

The TimeLock contract contains several functions that do not check whether the user has sent enough msg.value to cover the required execution costs. One example is the executeBatch function, which executes multiple transactions but does not validate whether the values in the values array are adequately covered by the msg.value sent with the transaction.

function executeBatch(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external override payable nonReentrant onlyRole(EXECUTOR_ROLE) {
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
// Check operation status
Operation storage op = _operations[id];
if (op.timestamp == 0) revert OperationNotFound(id);
if (op.executed) revert OperationAlreadyExecuted(id);
// Check timing conditions
if (block.timestamp < op.timestamp) revert OperationNotReady(id);
if (block.timestamp > op.timestamp + GRACE_PERIOD) revert OperationExpired(id);
// Check predecessor if specified
if (predecessor != bytes32(0)) {
if (!isOperationDone(predecessor)) {
revert PredecessorNotExecuted(predecessor);
}
}
​
// Mark as executed before external calls
op.executed = true;
​
// Execute each call
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
revert CallReverted(id, i);
}
}
​
emit OperationExecuted(id, targets, values, calldatas, predecessor, salt);
}

Vulnerability Details

The contract does not verify if msg.value is sufficient to cover the total required transaction values. This means a user can initiate an operation without sending enough ETH, potentially leading to failed transactions and unexpected behaviors. Attackers or careless users might cause disruptions by submitting underfunded transactions.

Impact

  • Transactions may fail midway, leaving some operations executed while others are not.

  • Users may mistakenly believe their transactions will succeed without realizing insufficient funds.

  • Potential security risks if certain conditions depend on successful execution but are only partially completed.

Tools Used

Manual review

Recommendations

  • Introduce a validation check at the beginning of the executeBatch function to ensure that msg.value is at least the sum of all values[i] in the batch.

  • Use require(msg.value >= totalValue, "Insufficient ETH sent"); to prevent execution unless the full amount is covered.

  • Refund excess ETH, if any, back to the sender.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!