code423n4 commented 3 years ago

Handle

0xRajeev

Vulnerability details

Impact

blockWithdrawal does not perform input validation to check if input address is non-zero, indeed has a non-zero withdrawals time as scheduled earlier via scheduleWithdrawal or if it is being executed within/outside the HOLD period.

Without such validation, the block could be accidentally attempted for an incorrect address, performed without regard for HOLD period (the override should ideally be allowed only with the HOLD timelock period), and cannot be monitored off-chain given the absence of event emission. Given that this is an emergency function, lack of such input validation and event emission could critically delay/affect incident response.

The missing event for such a critical onlyAdmin override function (along with missing event for the withdaw() function) which unconditionally overrides previously scheduled onlyAdmin withdrawals is by itself a concern.