Scope
src/MultiSigTimelock.sol: proposeTransaction, confirmTransaction

Root + Impact

Description

• Normal behavior: Multisigs should throttle proposal and approval cadence.

• Issue: There are no per-signer or global rate limits. An attacker with the owner key can spam thousands of proposals; a malicious signer can spam confirmations/revocations to create alert fatigue and front-run legitimate executions.

Risk

Likelihood:

• Reason 1 // Automation makes spam trivial

• Reason 2 // Social-engineering relies on noisy channels to hide payloads

Impact:

• Impact 1 // Signers miss critical malicious proposals buried in noise

• Impact 2 // Gas and time wasted on repeated confirmations/revocations

Proof of Concept

Explanation: Bot submits hundreds of proposals per minute; signers cannot review them all, increasing odds of approving a hidden malicious call.

Recommended Mitigation

Explanation: Add cooldowns and per-signer daily quotas on proposals and confirmations, enforced on-chain.