Llama - Atree's results

Lines of code

https://github.com/code-423n4/2023-06-llama/blob/9d641b32e3f4092cc81dbac7b1c451c695e78983/src/LlamaPolicy.sol#L404-L409

Vulnerability details

Impact

Malicious user can frontrun "createAction" to make "revokeExpiredRole" revert due to the "_assertNoActionCreationsAtCurrentTimestamp" check. So it is impossible to revoke a malicious role holder's role.

Proof of Concept

function _assertNoActionCreationsAtCurrentTimestamp() internal view {
    if (llamaExecutor == address(0)) return; // Skip check during initialization.
    address llamaCore = LlamaExecutor(llamaExecutor).LLAMA_CORE();
    uint256 lastActionCreation = LlamaCore(llamaCore).getLastActionTimestamp();
    if (lastActionCreation == block.timestamp) revert ActionCreationAtSameTimestamp();
}

If anyone is calling "revokeExpiredRole" to revoke an expired role and the role holder has action creation permission, the holder could frontrun the "createAction" function to make the "revokeExpiredRole" call revert because the lastActionCreation would then be equal to block.timestamp.

Tools Used

Manual Review

Recommended Mitigation Steps

Delete "_assertNoActionCreationsAtCurrentTimestamp"

Assessed type

DoS