Submission Details
Severity:
Bug Signer Revocation Does Not Invalidate Existing Confirmations in MultiSigTimelock.sol
Root + Impact
Description
Confirmations are counted numerically, not by active signer validity.
When a signer is revoked, their prior confirmations remain counted.
This creates inconsistent state where a transaction appears valid but cannot reach real consensus.
s_transactions[txnId].confirmations++; // @> No signer validity check
Risk
Likelihood:
Owner revokes a signer after confirmations exist
Happens naturally during governance changes
Impact:
Execution legitimacy becomes ambiguous
Governance disputes or frozen funds
PoC
// Alice, Bob, Charlie confirm tx
// Owner revokes Bob
// confirmations == 3, but only 2 valid signers remain
executeTransaction(txId); // Governance inconsistency
Mitigation
✅ Add signer-snapshot validation
struct Transaction {
...
address[] signersSnapshot;
}
Populate snapshot during proposal:
txn.signersSnapshot = s_signers;
Require confirmations only from snapshot signers.
Updates
Lead Judging Commences
kelechikizito 4 days ago
Submission Judgement Published Assigned finding tags:
Stale Confirmation Vulnerability/Ghost Voting Issue
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.