Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`TimeLockController::executeEmergencyAction()` Missing array length validation before for loop.

singularity0x00

Summary

TimeLockController::executeEmergencyActions() functions is used to perform calls using several arrays as parameters (targets[], values[], calldata[]), but it fails to validate that the arrays are equal in length which can make calls revert and in worse cases make calls with wrong parameters.

Vulnerability Details

This function allows an address with EMERGENCY_ROLE to perform calls by providing arrays as parameters.
Since it runs a for loop on the parameters It is assumed that all the arrays given as parameters are same length, but it fails to validate that assumption. and thus intentionally or by mistake the caller of this function can provide mismatched arrays which will be problematic.

function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
​
delete _emergencyActions[id];
​
//MISSING ARRAY LENGTH CHECK
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
if (returndata.length > 0) {
assembly {
let returndata_size := mload(returndata)
revert(add(32, returndata), returndata_size)
}
}
revert CallReverted(id, i);
}
}
​
emit EmergencyActionExecuted(id);
}

Impact

  • possible function reverts

  • calls revert

  • calls made to wrong targets with wrong parameters.

Recommendations

delete _emergencyActions[id];
​
++ if (targets.length != values.length && values.length != calldata.length) revert ArrayInvalidLength();
​
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!