MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Documentation Mismatch: DEFAULT_ADMIN_ROLE Not Granted

seenu1947

Root + Impact

Description

  • Normal behavior:
    Documentation states the deployer receives DEFAULT_ADMIN_ROLE for role governance.

Issue:
The contract never explicitly grants DEFAULT_ADMIN_ROLE. Role management relies solely on onlyOwner, creating a mismatch between documentation and implementation.

constructor() Ownable(msg.sender) {
_grantRole(SIGNING_ROLE, msg.sender);
}
​

Risk

Likelihood:

  • Occurs immediately after deployment

Surfaces during role audits or ownership transfers

Impact:

  • Confusing access-control model

  • Incorrect assumptions about admin privileges

Proof of Concept

hasRole(DEFAULT_ADMIN_ROLE, owner); // returns false
​

Recommended Mitigation

- Deployer receives DEFAULT_ADMIN_ROLE
+ Role administration is handled via Ownable at documentation level
​
or
​
+ _grantRole(DEFAULT_ADMIN_ROLE, msg.sender); at codelevel
​
Updates

Lead Judging Commences

kelechikizito Lead Judge
10 days ago
kelechikizito Lead Judge 4 days ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!