Closed code423n4 closed 2 years ago
It's about wardens appreciation of our ownership architecture versus ours. We can imagine many other malicious scenarios, assuming that the Multisig/Timelock/OwnerProxy combination is not enough to prevent the protocol from being compromised.
It's pretty clear that this is designed to be so.
Lines of code
https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/governance/TimelockControllerEmergency.sol#L295-L301
Vulnerability details
Impact
Having a bypass for the timelock defeats the purpose of a timelock. Anyone in the EMERGENCY_ROLE, or who is able to compromise the key is able to immediately make changes at the expense of users.
Proof of Concept
executeEmergency()
can take any action on behalf of the owner, immediately:https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/governance/TimelockControllerEmergency.sol#L295-L301
So essentially any rug vector is immediately available, e.g the of setting fees to 100%:
https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/NestedFactory.sol#L158-L172
Tools Used
Code inspection
Recommended Mitigation Steps
Only allow bypassing the timelock for specific actions, not arbitrary calls