Platform: Code4rena
Start Date: 24/07/2023
Pot Size: $100,000 USDC
Total HM: 18
Participants: 73
Period: 7 days
Judge: alcueca
Total Solo HM: 8
Id: 267
League: ETH
Rank: 25/73
Findings: 2
Award: $321.64
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: immeas
Also found by: 0xkazim, ABAIKUNANBAEV, T1MOH, berlin-101, bin2chen, kutugu, markus_ether
59.6773 USDC - $59.68
In TemporalGovernor.sol, there is permissionlessUnpauseTime that can be set in the constructor by the owner (the guardian). The guardian has the right to set this parameter but the governance decides whether to grant the guardian the pausing ability or not. The problem is that, after calling togglePause() function, the guardian ability is revoked and the permissionlessUnpause() will be called when it's past pause window. The guardian has influence over permissionlessUnpauseTime and can set it to any number so that the contract cannot be unpaused again.
https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/Governance/TemporalGovernor.sol#L69 https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/Governance/TemporalGovernor.sol#L248-251
Manual review
Set some bounds for permissionlessUnpauseTime so that the guardian couldn't possibly manipulate it.
Timing
#0 - c4-pre-sort
2023-08-03T13:29:18Z
0xSorryNotSorry marked the issue as duplicate of #232
#1 - c4-judge
2023-08-12T20:50:04Z
alcueca marked the issue as satisfactory
#2 - c4-judge
2023-08-12T20:50:15Z
alcueca marked the issue as partial-25
🌟 Selected for report: Aymen0909
Also found by: ABAIKUNANBAEV, Jigsaw, hals, sces60107
261.9578 USDC - $261.96
In TemporalGovernor.sol, the guardian is supposed to call fastTrackProposalExecution() in a pausing state of the contract when the governance is compromised and it's crucial to execute new proposals fast with queueTime == 0. However, current implementation of this function contains only onlyOwner modifier and it doesn't make sure that the contract is in a pausing state. This opens up a possibility for the guardian to execute any proposals without delay.
https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/Governance/TemporalGovernor.sol#L266-268 https://github.com/code-423n4/2023-07-moonwell/blob/main/src/core/Governance/TemporalGovernor.sol#L364-367
Manual review.
Add whenPaused modifier to the fastTrackProposalExecution() function
Other
#0 - c4-pre-sort
2023-08-03T13:53:46Z
0xSorryNotSorry marked the issue as duplicate of #245
#1 - c4-judge
2023-08-12T20:42:22Z
alcueca marked the issue as satisfactory
#2 - c4-judge
2023-08-12T20:42:26Z
alcueca marked the issue as partial-50