Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Governance Proposal State Not Updated After Emergency Execution

josh4324

Summary

The function executeEmergencyAction() is designed to allow emergency execution of transactions through the Timelock contract. However, it does not update the proposal's execution status in the governance contract.

As a result, even after a proposal is executed using emergency action, its state in the governance contract remains unchanged. This inconsistency could allow proposals to be executed multiple times.

Vulnerability Details

function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
delete _emergencyActions[id];
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
if (returndata.length > 0) {
assembly {
let returndata_size := mload(returndata)
revert(add(32, returndata), returndata_size)
}
}
revert CallReverted(id, i);
}
}
​
emit EmergencyActionExecuted(id);
}
​

The function executes emergency transactions but does not update the governance contract’s proposal state. The proposal remains marked as not executed, leading to inconsistencies.

Since the governance contract still considers the proposal unexecuted, it can be executed again through standard means, leading to unintended multiple executions.

Impact

Proposals can be executed twice, leading to double transfers, duplicate parameter changes, or security risks.

Tools Used

Manual Review

Recommendations

implement executeEmergencyAction from the governance contract and update proposal state

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController.executeEmergencyAction doesn't mark operations as executed, allowing the same operation to be executed again through the regular path

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController.executeEmergencyAction doesn't mark operations as executed, allowing the same operation to be executed again through the regular path

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!