Summary

The executeEmergencyAction function in the TimelockController contract allows privileged users with the EMERGENCY_ROLE to execute emergency actions immediately after scheduling them, without enforcing the intended EMERGENCY_DELAY (1 day). The lack of a delay check undermines the security assumptions of the timelock mechanism, potentially allowing malicious or erroneous emergency actions to be executed instantly.

Vulnerability Details

The TimelockController contract defines a constant delay:

• EMERGENCY_DELAY

However, in the executeEmergencyAction function, there is no verification to ensure that this delay has elapsed after scheduling .

• The scheduleEmergencyAction function merely sets a boolean flag without recording the timestamp.

  function scheduleEmergencyAction(bytes32 id) external onlyRole(EMERGENCY_ROLE) {

  _emergencyActions[id] = true;

  emit EmergencyActionScheduled(id, block.timestamp);

  }

  ​

Since executeEmergencyAction only checks the boolean _emergencyActions[id] and deletes it without any time check, an actor with EMERGENCY_ROLE can schedule and immediately execute an emergency action in a single transaction.

Impact

Malicious actions such as fund transfers, protocol upgrades, or governance takeovers can be executed immediately by a compromised EMERGENCY_ROLE holder.

Tools Used

Manual Review

Recommendations

1. ** Enforce EMERGENCY_DELAY:**
   Store the scheduling timestamp instead of a boolean in _emergencyActions.

   -- mapping(bytes32 => bool) private _emergencyActions;

   ++ mapping(bytes32 => uint256) private _emergencyActions;

2. Update scheduleEmergencyAction to record the timestamp:

3. Add a delay check in executeEmergencyAction: