Core Contracts

Summary

The TimelockController contract defines an EMERGENCY_DELAY constant of 1 day but fails to enforce this delay in its emergency action execution logic. This allows emergency actions to be executed immediately after scheduling, effectively bypassing the timelock protection mechanism.

Vulnerability Details

The TimelockController implements two distinct operation paths:

1. Regular operations (through scheduleBatch and executeBatch)

2. Emergency operations (through scheduleEmergencyAction and executeEmergencyAction)

While regular operations properly enforce a minimum delay of 2 days (MIN_DELAY), the emergency operations path contains a critical flaw:

The _emergencyActions mapping does not track when the emergency action was scheduled; it only stores a boolean flag. There's no timestamp associated with the emergency action:

executeEmergencyAction only checks if the action is scheduled but doesn't enforce any delay:

The EMERGENCY_DELAY constant (1 day) exists but is completely unused:

This vulnerability effectively nullifies the timelock protection for emergency actions, despite the contract clearly intending to have a 1-day delay as evidenced by the EMERGENCY_DELAY constant.

Impact

Emergency actions can be executed instantly after scheduling, defeating the primary purpose of a timelock controller.

Tools Used

Manual Review

Recommendations

The EMERGENCY_DELAY should be enforced by requiring that block.timestamp >= scheduledTimestamp + EMERGENCY_DELAY before execution.