Submission Details
Severity:
veRAACToken.sol::executeEmergencyUnlock() sets the emergencyUnlockEnabled to true, but once unlocked, it can never be set to false.
Summary
In order to emergencyUnlockEnabled to become true, the owner must call scheduleEmergencyUnlock() and then wait for EMERGENCY_DELAY(3days).
Then the owner will be able to call executeEmergencyUnlock() successfully which sets the emergencyUnlockEnabled to true.
Vulnerability Details
Once emergencyUnlockEnabled has been set to true, it can never be set to false.
This might confuse users and frontend applications.
// @audit there is no way to turn it back to false.
function executeEmergencyUnlock() external onlyOwner withEmergencyDelay(EMERGENCY_UNLOCK_ACTION) {
emergencyUnlockEnabled = true;
emit EmergencyUnlockEnabled();
}
Impact
emergencyUnlockEnabled can never be set back to false once its set to true.
Tools Used
Manual
Recommendations
Add a function where this can be switched back to false or add a time window.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::executeEmergencyUnlock is dormant, it configures a system that's never used
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.