MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

No emergency cancel mechanism for proposed high-risk transactions

Author Revealed upon completion

Scope
src/MultiSigTimelock.sol: MultiSigTimelock

Root + Impact

Description

  • Normal behavior: Once proposed, transactions cannot be canceled; only revocations of confirmations are possible.

  • Issue: In a compromise scenario, inability to cancel proposed transactions forces reliance on signer coordination; high-risk window remains open.

// @> No cancel function to mark a proposal invalid and prevent execution

Risk

Likelihood:

  • Reason 1 // Compromised owner can propose dangerous calls

  • Reason 2 // Slow coordination among signers

Impact:

  • Impact 1 // Increased chance malicious execution succeeds

  • Impact 2 // Operational risk and alert fatigue

Proof of Concept

Explanation: A malicious proposal sits in the queue. Even if signers don't confirm, it remains "open" forever (see H6). There is no way to explicitly "kill" it.

// Dangerous proposal remains executable as long as 3 signers can be coerced

Recommended Mitigation

Explanation: Add a cancelTransaction function callable by the proposer or owner.

+ function cancelTransaction(uint256 txnId) external onlyRole(SIGNING_ROLE) {
+ // mark as executed or add a canceled flag checked in confirm/execute
+ }

Status: Valid (Design Flaw)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!