MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Confirmation Count Can Become Inconsistent With Actual Signatures

cybervenom

Root + Impact

Description

  • The contract tracks confirmations using:

    • a mapping: s_signatures[txnId][signer]

    • a counter: s_transactions[txnId].confirmations

    • The counter is expected to always match the number of true signature entries.


    • The contract trusts the counter during execution (_executeTransaction) but never re-validates it against the signature mapping. If the counter ever becomes inconsistent (due to future changes, role revocation edge cases, or logic bugs), a transaction may execute with fewer real approvals than intended.

if (txn.confirmations < REQUIRED_CONFIRMATIONS) {
revert MultiSigTimelock__InsufficientConfirmations(...);
}

Risk

Likelihood:

  • Occurs when signer roles are revoked after confirmation

  • Occurs if future code paths mutate confirmations incorrectly

Impact:

  • Transaction executes with fewer than 3 valid signer approvals

Governance and multisig guarantees weakened

Proof of Concept

// Scenario (conceptual):
// 1. Signer A, B, C confirm → confirmations = 3
// 2. Admin revokes SIGNING_ROLE from signer C
// 3. confirmations counter still = 3
// 4. executeTransaction() succeeds even though only A & B are valid signers

Recommended Mitigation

Recalculate confirmations dynamically at execution time OR enforce invariant:

+ uint256 actualConfirmations = 0;
+ for (uint256 i = 0; i < signerList.length; i++) {
+ if (s_signatures[txnId][signerList[i]]) {
+ actualConfirmations++;
+ }
+ }
+ require(actualConfirmations >= REQUIRED_CONFIRMATIONS, "Invalid confirmations");
​
Updates

Lead Judging Commences

kelechikizito Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Stale Confirmation Vulnerability/Ghost Voting Issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!