Root + Impact

Description

• A timelock must guarantee that once configured, no actor (including the multisig itself) can remove or weaken the delay without first respecting the existing delay.

• The multisig is allowed to execute calls to itself through the timelock, enabling a queued transaction to modify or remove the timelock configuration itself. This creates a self-referential governance vulnerability where the timelock protects everything except itself.

Risk

Likelihood:

• Governance systems routinely allow self-calls for upgrades.

Attack requires only signer collusion or key compromise — a realistic threat model.

Impact:

• Permanent removal of timelock guarantees.

Immediate execution of malicious upgrades, asset drains, or signer replacement.

Proof of Concept

• The timelock enforces delay on transactions, but not on mutations of the timelock itself, allowing governance capture.

Recommended Mitigation