Core Contracts

Summary

The emergency shutdown function in the RAACMinter contract is intended to be restricted to accounts possessing a dedicated emergency shutdown role. However, the function currently uses the DEFAULT_ADMIN_ROLE for access control, bypassing the designated EMERGENCY_SHUTDOWN_ROLE.

Vulnerability Details

The contract declares a constant for the emergency shutdown role as follows:

Despite this, the emergencyShutdown function is implemented with the following access control modifier:

This misconfiguration means that only accounts with the DEFAULT_ADMIN_ROLE can trigger an emergency shutdown, instead of accounts specifically designated with the EMERGENCY_SHUTDOWN_ROLE. The intended separation of roles is therefore not enforced, potentially leading to scenarios where accounts with broader administrative privileges can exercise emergency control functions that were meant to be more restricted.

Impact

• Over-Permissioned Access: The emergency shutdown functionality becomes accessible to all default admin accounts, which might not be desirable. This could allow an administrator with wide-ranging control to trigger an emergency shutdown without the additional checks intended for the emergency shutdown role.

• Reduced Granularity of Control: The misconfigured access control undermines the intended separation of responsibilities, potentially increasing the risk of misuse or human error in crisis management scenarios.

Tools Used

• Manual code review

Recommended Mitigation

• Enforce Correct Role: Modify the emergencyShutdown function to use onlyRole(EMERGENCY_SHUTDOWN_ROLE) instead of onlyRole(DEFAULT_ADMIN_ROLE). This ensures that only those specifically designated with the emergency shutdown privileges can execute the function.

  For example:

  function emergencyShutdown(bool updateLastBlock, uint256 newLastUpdateBlock) external onlyRole(EMERGENCY_SHUTDOWN_ROLE) {

  emissionRate = 0;

  _pause();

  if (updateLastBlock) {

  _setLastUpdateBlock(newLastUpdateBlock);

  }

  emit EmergencyShutdown(msg.sender, lastUpdateBlock);

  }