Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

operations can be executed again when emergency action is called in TimelockController.sol

peanuts

Summary

The executeEmergencyAction() in TimelockController.sol executes the actions in operation[id] but it does not delete the _operations[id] mapping.

When an operation is in the execution stage and emergencyAction() is called, the action can be executed again.

Vulnerability Details

An operation can be scheduled in TimelockController.sol directly through scheduleBatch() or through a successful proposal in Governance.sol.

_timelock.scheduleBatch(
proposal.targets,
proposal.values,
proposal.calldatas,
bytes32(0),
salt,
_timelock.getMinDelay()
);
​

For proposals in Governance.sol, this is the rough timeline:

`propose() -> castVotes() -> execute() -> queueProposal() (TC.sol) -> execute() -> executeProposal() (TC.sol)

If anywhere after the first execute() and emergencyAction() is called, this proposal will still continue to go through the stages and can be called again unless the CANCELLER_ROLE cancels the operation.

Impact

Actions can be called again.

Tools Used

Manual Review

Recommendations

Delete _operations[id] in the emergencyAction() function.

delete _operations[id];

Or set the _operations[id].executed to true so it cannot be executed again

Operation storage op = _operations[id];
op.executed = true;
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController.executeEmergencyAction doesn't mark operations as executed, allowing the same operation to be executed again through the regular path

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController.executeEmergencyAction doesn't mark operations as executed, allowing the same operation to be executed again through the regular path

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.