Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

emergencyWithdraw() waits for 6 days instead of 3

t0x1c

Description

The emergency withdrawal system in veRAACToken consists of three main steps:

  1. Schedule Emergency Action (Owner only) link to code

function scheduleEmergencyAction(bytes32 actionId) external onlyOwner {
_emergencyTimelock[actionId] = block.timestamp;
emit EmergencyActionScheduled(actionId, block.timestamp + EMERGENCY_DELAY); // @audit-info : EMERGENCY_DELAY = 3 days
}

  1. Enable Emergency Withdrawal (Owner only, after delay of 3 days) link to code

function enableEmergencyWithdraw() external onlyOwner withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) {
emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY;
emit EmergencyWithdrawEnabled(emergencyWithdrawDelay);
}

  1. Execute Emergency Withdrawal (Users, after both delays) link to code

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
// ... withdrawal logic
}

The current implementation creates an unintended double delay:

  1. Initial 3-day timelock delay through EMERGENCY_DELAY

  2. Additional 3-day delay added in enableEmergencyWithdraw()

Impact

This results in a total 6-day waiting period when only 3 days may have been intended.
Since this is an emergency function, an additional 3 days are critical.

Mitigation

Modify the enableEmergencyWithdraw() function to remove the additional delay:

function enableEmergencyWithdraw() external onlyOwner withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) {
- emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY;
+ emergencyWithdrawDelay = block.timestamp; // Remove additional delay
emit EmergencyWithdrawEnabled(emergencyWithdrawDelay);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken implements two consecutive 3-day emergency delays (totaling 6 days), hindering timely emergency response when funds need to be withdrawn quickly

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.