Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Permanent Emergency Withdrawal Window Due to Unreset `emergencyWithdrawDelay`

0x23r0

Summary

In the emergency withdrawal mechanism in the veRAACToken contract once the emergencyWithdrawDelay is set by the enableEmergencyWithdraw function, it remains active indefinitely. This means that users can continue to withdraw their locked tokens even after the emergency situation has been resolved, as there is no mechanism to reset or disable the emergencyWithdrawDelay. This could lead to unintended withdrawals and potential loss of protocol integrity.

Vulnerability Details

The enableEmergencyWithdraw function sets the emergencyWithdrawDelay to block.timestamp + EMERGENCY_DELAY, allowing users to withdraw their locked tokens after the delay has passed. However, once this delay is set, it is never reset or disabled, meaning the emergency withdrawal functionality remains active forever. This is problematic because:

  1. The contract does not provide a way to disable the emergency withdrawal mechanism once it is enabled.

  2. Users can continue to withdraw their tokens even after the emergency situation has been resolved, potentially leading to a loss of locked tokens and protocol stability.

  3. The protocol owner has no way to revoke the emergency withdrawal functionality, reducing their control over the contract.

function enableEmergencyWithdraw() external onlyOwner withEmergencyDelay(EMERGENCY_WITHDRAW_ACTION) {
emergencyWithdrawDelay = block.timestamp + EMERGENCY_DELAY;
emit EmergencyWithdrawEnabled(emergencyWithdrawDelay);
}

The emergencyWithdrawDelay is set but never reset, allowing the emergencyWithdraw function to remain active indefinitely:

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
// Withdrawal logic...
}

  1. Enable Emergency Withdrawal: The owner calls enableEmergencyWithdraw, setting emergencyWithdrawDelay to block.timestamp + EMERGENCY_DELAY.

  2. Wait for Delay: After the delay has passed, users can call emergencyWithdraw to withdraw their tokens.

  3. Indefinite Access: Even after the emergency is resolved, users can continue to withdraw their tokens indefinitely because emergencyWithdrawDelay is never reset.

Impact

The protocol owner cannot disable the emergency withdrawal mechanism, reducing their ability to manage the contract effectively.

Tools Used

Manual Review

Recommendations

Introduce a function that allows the owner to reset or disable the emergencyWithdrawDelay, Ensure the emergency withdrawal mechanism is only active for a specific period and automatically disables itself after the emergency is resolved.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw permanently enables lock-bypassing after activation with no way to disable it, permanently breaking token time-locking functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.