Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`TimelockController::executeEmergencyAction` doesn't check for `EMERGENCY_DELAY` period before executing an emergency action

77SecMentees

Summary

The TimelockerController.sol::scheduleEmergencyAction and TimelockerController.sol::executeEmergencyAction are functions to accelerate the proposal process and jump the usual delay to be executed in a short period of time. However, it still needs to wait for a minimum delay, and that is what the TimelockerController implements a constant variable to have a delay over emergency actions.

Vulnerability Details

The problem is thatEMERGENCY_DELAYis never used and any operation can be instantly executed once scheduled.

Impact

Emergency actions can be executed immediately not giving time for users to acknowledge the situation and decide what to do.

Tools Used

Code Review

Recommendations

Check if block.timestampis bigger than _operations[id].timestamp + EMERGENCY__DELAYand then execute the action.

function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
+ if(block.timestamp < _operations[id].timestamp + EMERGENCY__DELAY) revert();
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
​
...snip...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!