Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

TimelockController emergency actions can be executed instantly

0xalexsr

Summary

Governances use timelocks to manage governance operations. RAAC implemented emergency operations on the timelockController which is expected to have a delay of 1 day but it isn't properly implemented causing emergency operations to be executed instantly

Vulnerability Details

in TimeLockController::executeEmergencyAction

/**
* @notice Executes an emergency action
* @dev Only callable by addresses with EMERGENCY_ROLE
* @param targets Target addresses for emergency calls
* @param values ETH values for emergency calls
* @param calldatas Calldata for emergency calls
* @param predecessor ID of operation that must be executed before
* @param salt Random value for operation ID
*/
function executeEmergencyAction(
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt
) external payable onlyRole(EMERGENCY_ROLE) nonReentrant {
bytes32 id = hashOperationBatch(targets, values, calldatas, predecessor, salt);
if (!_emergencyActions[id]) revert EmergencyActionNotScheduled(id);
delete _emergencyActions[id];
for (uint256 i = 0; i < targets.length; i++) {
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
if (!success) {
if (returndata.length > 0) {
assembly {
let returndata_size := mload(returndata)
revert(add(32, returndata), returndata_size)
}
}
revert CallReverted(id, i);
}
}
​
emit EmergencyActionExecuted(id);
}

When called, it is executed instantly where no check is made on any delay on opposite to documentation, the following variable is not implemented at all

uint256 public constant EMERGENCY_DELAY = 1 days;

Impact

Impact is High as governance operations must implement the timelock, emergency operations should implement a delay but in this case it can be instantly executed causing trust problems and could result in loss of funds.

Recommendations

Add a delay check in executeEmergencyAction

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimelockController emergency actions bypass timelock by not enforcing EMERGENCY_DELAY, allowing immediate execution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!