MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Unbounded proposal queue enables storage/gas denial of service

365smile

Scope
src/MultiSigTimelock.sol: proposeTransaction, s_transactions, s_transactionCount

Root + Impact

Description

  • Normal behavior: Proposals should be rate-limited or purgeable.

  • Issue: Anyone controlling the owner key can spam unbounded proposals. Each entry is stored permanently with calldata, bloating storage, raising gas for executeTransaction (due to higher cold SLOAD costs) and making indexers/dashboards unusable.

function proposeTransaction(...) external ... onlyOwner returns (uint256) {
s_transactions[transactionId] = Transaction({ ... data ... });
s_transactionCount++;
}

Risk

Likelihood:

  • Reason 1 // Owner key compromise enables griefing

  • Reason 2 // Even honest use can accidentally enqueue thousands of drafts

Impact:

  • Impact 1 // Contract becomes prohibitively expensive to interact with as storage grows

  • Impact 2 // Off-chain review pipelines choke, increasing chance of signing malicious items hidden in noise

Proof of Concept

Explanation: Script 50,000 proposals with dummy calldata. Gas to confirm/execute later transactions rises because every s_transactions slot becomes a cold access, and forensic review becomes impractical.

// loop proposeTransaction in a for loop; state grows unbounded

Recommended Mitigation

Explanation: Add per-interval proposal caps and a cancel/cleanup path that deletes storage (e.g., via delete s_transactions[id]) to reclaim gas refunds.

+ require(_proposalCountFor(msg.sender, dayIndex) < MAX_DAILY_PROPOSALS, "rate limited");
+ function cancelTransaction(uint256 txnId) external { delete s_transactions[txnId]; }

Status: Valid (DoS)

Updates

Lead Judging Commences

kelechikizito Lead Judge 4 days ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!