Submission Details
Severity:
Extra delay is added to emergency withdrawal
Summary
In the veRAACToken contract when an emergency withdraw is scheduled it needs to wait for 3 days (an EMERGENCY_DELAY period) to be able to call the enableEmergencyWithdraw function in which another EMERGENCY_DELAY period is added. This means that it takes 6 days from an emergency withdrawal being scheduled to the time users can actually withdraw.
This might be the intended functionality but I'm reporting in case it isn't.
Impact
Extra delay period is added to execute an emergency action.
Tools Used
Manual review
Recommendations
Remove the extra emergency delay from the enableEmergencyWithdraw function:
function enableEmergencyWithdraw() external onlyOwner withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) {
- emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY;
+ emergencyWithdrawDelay = block.timestamp;
emit EmergencyWithdrawEnabled(emergencyWithdrawDelay);
}
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken implements two consecutive 3-day emergency delays (totaling 6 days), hindering timely emergency response when funds need to be withdrawn quickly
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.