Submission Details
Severity:
executeEmergencyAction does not work as commented
Summary
In TimelockController.sol According comment section executeEmergencyAction Function Logic does not work as mention in comment section. Because in comment have predecessor ID of operation that must be executed before. But in Function logic predecessor ID is checking is missing.
Vulnerability Details
Observe those marked line...
/**
* @notice Executes an emergency action
* @dev Only callable by addresses with EMERGENCY_ROLE
* @param targets Target addresses for emergency calls
* @param values ETH values for emergency calls
* @param calldatas Calldata for emergency calls
@>>> * @param predecessor ID of operation that must be executed before
* @param salt Random value for operation ID
*/
function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
delete _emergencyActions[id];
@>>> Checking predecessor is missing there
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
if (returndata.length > 0) {
assembly {
let returndata_size := mload(returndata)
revert(add(32, returndata), returndata_size)
}
}
revert CallReverted(id, i);
}
}
emit EmergencyActionExecuted(id);
}
Impact
function does not work correctly.
Tools Used
maual review
Recommendations
Correct that if needed.
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
TimelockController::executeEmergencyAction accepts predecessor parameter but unlike executeBatch doesn't verify it's executed, breaking operation sequencing in emergencies
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.