PartyGovernance.disableEmergencyExecute() permanently disables emergencyExecute()

[code423n4]

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/party/PartyGovernance.sol#L800-L802

Vulnerability details

Impact

PartyGovernance.disableEmergencyExecute() will permanently disable PartyGovernance.emergencyExecute() as there is no other means to toggle emergencyExecuteDisabled back to false. This means emergencyExecute() can never be called once

Proof of Concept

https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/party/PartyGovernance.sol#L800-L802

Tools Used

Manual review

Recommended Mitigation Steps

The logic should allow toggling the emergencyExecuteDisabled state

[merklejerk]

That's the intended design.

[HardlyDifficult]

This is a design choice - there are pros and cons to allowing it to flip back but that's not explored in this report so closing as invalid.