Moonwell - Jigsaw's results

Lines of code

https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/Governance/TemporalGovernor.sol#L266

Vulnerability details

Impact

Detailed description of the impact of this finding. Guardians are able to fasttrack and execute proposals even when the contract is not paused. per the comments: @notice Allow the guardian to process a VAA when the /// Temporal Governor is paused this is only for use during /// periods of emergency when the governance on moonbeam is /// compromised and we need to stop additional proposals from going through. /// @param VAA The signed Verified Action Approval to process however the function itself is missing a whenPaused modifier, allowing a guardian to fastrack and execute proposals even the contract is not paused.

Proof of Concept

W/o a whenPaused modifier, guardian/owner is able to execute fasttracked proposals even when governance is not compromised.

Tools Used

manual review

Recommended Mitigation Steps

add whenPaused modifier.

Assessed type

Governance