MultiSig Timelock

Description

The proposeTransaction() function is restricted by the onlyOwner modifier, allowing only the contract owner to create transaction proposals. This behavior contradicts the documented design, which states that any address holding the SIGNING_ROLE should be able to propose transactions. As a result, signers are limited to confirming and executing transactions but cannot independently initiate proposals.

This creates a mismatch between the contract’s documented governance model and its actual implementation.

Impact

• centralization risk, the owner becomes a single point of control for all transaction initiation.

• Prevents signers from proposing urgent or corrective transactions if the owner is unavailable, compromised, or unresponsive.

• Breaks assumptions made by users, auditors, and integrators who rely on the documentation.

• Reduces fault tolerance and decentralization guarantees expected from a multisignature wallet.

Affected Area

permalink: https://github.com/CodeHawks-Contests/2025-12-multisig-timelock/blob/3c88fea850b25724b71778bdc7bfe96c3bd97b63/src/MultiSigTimelock.sol#L249

Proof of Concept

output:

Recommended Mitigation

replace the onlyOwner modifier with role-based access control

This allows any authorized signer to propose transactions while preserving multisignature confirmation and timelock security.