Core Contracts

Summary

The emergency withdrawal mechanism in the veRAACToken contract unintentionally applies the EMERGENCY_DELAY of 3 days twice, resulting in a total delay of 6 days before users can withdraw funds in emergencies.

Vulnerability Details

The scheduleEmergencyAction must be called before an emergency unlock because of the scheduleTime check in the withEmergencyDelay modifier:

In the withEmergencyDelay modifier, _emergencyTimelock (cannot be 0) is used to create the first delay by adding EMERGENCY_DELAY to it:

Since the enableEmergencyWithdraw function has the withEmergencyDelay modifier, it can only be called after the first delay has passed. enableEmergencyWithdraw adds another EMERGENCY_DELAY:

The emergencyWithdraw function can be executed successfully only after the second delay:

Impact

Users are locked out of withdrawals for double the intended time, which would be critical in emergency situations.

Recommendations

Apply the emergency delay only once. Even 3 days is considerable, and EMERGENCY_DELAY could be reduced.