MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Renouncing Ownership Bricks Protocol

ashutoshcshah

Description

The contract inherits Ownable from OpenZeppelin, which includes the renounceOwnership() function. This function allows the owner to set the owner to address(0).
Since proposeTransaction is restricted to onlyOwner (as per Finding M-1), calling renounceOwnership() results in a state where no new transactions can ever be proposed. The protocol can continue to confirm/execute existing proposals, but is effectively dead for any new activity.
This is particularly dangerous as renounceOwnership is often used in decentralization roadmaps, but here it leads to a denial of service.

/// File: src/MultiSigTimelock.sol:253
onlyOwner

Risk

Likelihood: medium (Owner must call it).
Impact: High (Permanent DoS of new proposals).

Proof of Concept

  1. Owner calls renounceOwnership().

  2. Owner tries proposeTransaction(...) -> Reverts.

  3. Signers try proposeTransaction(...) -> Reverts.

  4. Protocol is bricked.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import {Test, console} from "forge-std/Test.sol";
import {MultiSigTimelock} from "../../src/MultiSigTimelock.sol";
​
contract TestOwnershipOps is Test {
MultiSigTimelock public multiSig;
address public deployer;
address public alice;
​
function setUp() public {
deployer = makeAddr("deployer");
alice = makeAddr("alice");
vm.prank(deployer);
multiSig = new MultiSigTimelock();
vm.prank(deployer);
multiSig.grantSigningRole(alice);
}
​
function test_RenounceOwnership_BricksProposals() public {
// 1. Owner renounces ownership
vm.prank(deployer);
multiSig.renounceOwnership();
​
// 2. Try to propose - Should fail
vm.prank(deployer);
vm.expectRevert(); // OwnableUnauthorizedAccount
multiSig.proposeTransaction(address(0x123), 0, "");
​
// 3. Try to propose as signer - Should fail (M-1)
vm.prank(alice);
vm.expectRevert();
multiSig.proposeTransaction(address(0x123), 0, "");
​
// Result: No one can ever propose again.
}
}
​
​

Recommended Mitigation

  1. Override renounceOwnership to revert or disable it.

  2. OR (Preferred) Allow Signers to propose transactions (Fix M-1).

Updates

Lead Judging Commences

kelechikizito Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Owner revokes her signing role

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!