snapshot-labs / sx-evm

Core smart contracts of Snapshot X for EVM
https://docs.snapshotx.xyz
22 stars 12 forks source link

audit: TimelockExecutionStrategy Deployed as Proxy at Risk From Implementation SELFDESTRUCT #223

Closed Orland0x closed 1 year ago

Orland0x commented 1 year ago

It is expected that TimelockExecutionStrategy will be deployed as a proxy contract. However, it is critical that the implementation contract shared by the proxies is disabled, and cannot execute transactions. If the base implementation contract is in operation, a transaction could perform a delegate call into a contract containing the SELFDESTRUCT opcode, irrecoverably disabling all the proxies using that implementation.