Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing 1 day delay for emergency actions in TimelockController contract.

tadev

Summary

As per the documentation: "Emergency actions have 1-day delay". Indeed, we can find the following constant variable declaration in the TimelockController contract but it is never used:

uint256 public constant EMERGENCY_DELAY = 1 days;

The emergency procedure consists of 2 functions:

function scheduleEmergencyAction(bytes32 id) external onlyRole(EMERGENCY_ROLE) {
_emergencyActions[id] = true;
emit EmergencyActionScheduled(id, block.timestamp);
}
​
function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
// @audit MEDIUM: missing 24 hours delay for emergency action
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
​
delete _emergencyActions[id];
​
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
if (returndata.length > 0) {
assembly {
let returndata_size := mload(returndata)
revert(add(32, returndata), returndata_size)
}
}
revert CallReverted(id, i);
}
}
​
emit EmergencyActionExecuted(id);
}

The problem arises because there is no timelock feature in the emergency withdrawal process. One can call scheduleEmergencyAction and directly call executeEmergencyAction right after, and it will succeed.

Impact

The impact of this issue is medium, given that there is no timelock for the emergency procedure while it should be present as specified in the documentation.

Tools Used

Manual review.

Recommendations

Make sure to add a timelock mechanism for the emergency withdrawal process.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.