Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Double emergency withdrawal delay in `veRAACToken`

nikikiki

Summary

In the veRAACToken contract the EMERGENCY_DELAY is supposed to be 3 days but is unintentionally implemented 2 consecutive times, which results in a total waiting time of 6 days before users can withdraw their funds in emergency situations.

Vulnerability Details

The emergency withdrawal process requires the owner to call scheduleEmergencyAction and to wait for EMERGENCY_DELAY (3 days) due to the withEmergencyDelay modifier:

modifier withEmergencyDelay(bytes32 actionId) {
uint256 scheduleTime = _emergencyTimelock[actionId];
if (scheduleTime == 0) revert EmergencyActionNotScheduled();
> if (block.timestamp < scheduleTime + EMERGENCY_DELAY) revert EmergencyDelayNotMet();
_;
delete _emergencyTimelock[actionId];
}
function scheduleEmergencyAction(bytes32 actionId) external onlyOwner {
> _emergencyTimelock[actionId] = block.timestamp;
emit EmergencyActionScheduled(actionId, block.timestamp + EMERGENCY_DELAY);
}

Then the owner can call enableEmergencyWithdraw and after another 3 days users can finally withdraw their tokens. This creates a total delay of 6 days before any emergency action can be taken.

function enableEmergencyWithdraw() external onlyOwner withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) {
> emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY;
emit EmergencyWithdrawEnabled(emergencyWithdrawDelay);
}

Impact

The unintended double delay period significantly hinders the contract's ability to respond to emergencies effectively. In emergency situations where immediate action is required , the 6-day waiting period could result in a loss of user funds, which completely undermines the purpose of having an emergency withdrawal feature.

Recommendations

Consider fixing the double delay and even reducing it, as 3 days may already be excessive.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken implements two consecutive 3-day emergency delays (totaling 6 days), hindering timely emergency response when funds need to be withdrawn quickly

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.