Llama - BLOS's results

Lines of code

https://github.com/code-423n4/2023-06-llama/blob/9d641b32e3f4092cc81dbac7b1c451c695e78983/src/LlamaPolicy.sol#L404-L409

Vulnerability details

Impact

"_assertNoActionCreationsAtCurrentTimestamp" can be used to DOS "revokeExpiredRole"

Proof of Concept

If someone tries to revoke an expired role, they will need to call "revokeExpiredRole". But the role holder can frontrun "createAction" at the same timestamp to make that call revert.

function _assertNoActionCreationsAtCurrentTimestamp() internal view {
    if (llamaExecutor == address(0)) return; // Skip check during initialization.
    address llamaCore = LlamaExecutor(llamaExecutor).LLAMA_CORE();
    uint256 lastActionCreation = LlamaCore(llamaCore).getLastActionTimestamp();
    if (lastActionCreation == block.timestamp) revert ActionCreationAtSameTimestamp();
}

Tools Used

Manual

Recommended Mitigation Steps

Don't use "_assertNoActionCreationsAtCurrentTimestamp"

Assessed type

DoS