MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

Role Revocation Does Not Invalidate Existing Confirmations

Author Revealed upon completion

Root + Impact

Only addresses with SIGNING_ROLE should influence transaction execution.

Description

If a signer:

  1. Confirms a transaction

  2. Later loses SIGNING_ROLE

Their confirmation remains valid forever, even though they are no longer authorized.

// @> No cleanup of s_signatures when SIGNING_ROLE is revoked
s_signatures[txnId][formerSigner] == true
​

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Occurs when admin removes compromised or malicious signer

Occurs during signer rotation

Impact:

  • Revoked signers still influence fund movement

Breaks role-based security model

Proof of Concept

// 1. Signer A confirms txn
// 2. Admin revokes SIGNING_ROLE from A
// 3. Transaction still counts A's confirmation
​

Recommended Mitigation

Or enforce onlyRole(SIGNING_ROLE) at execution-time confirmation validation.

+ function revokeRole(...) internal override {
+ _clearSignerConfirmations(account);
+ }
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!