Submission Details
Severity:
Operations can be scheduled multiple times with the same ID
Summary
The function hashOperationBatch() generates a deterministic hash based on the input parameters.
This means if a user submits the exact same batch (targets, values, calldatas, predecessor, salt), the same id will be generated.
This could allow replay attack where sensitive transaction (e.g., transferring funds) is re-executed.
Impact
duplicate scheduling
Replay attacks
No proper tracking
Tools Used
Manual Review
Recommendations
Modify hashOperationBatch() to include a Nonce
operationNonce++; // Increment nonce after each operation
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
Governance generates non-unique timelock operation IDs for different proposals with identical parameters, allowing timelock bypass and proposal DoS attacks
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
Governance generates non-unique timelock operation IDs for different proposals with identical parameters, allowing timelock bypass and proposal DoS attacks
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.