Skip to content

Timelock Bypass — Admin Can Also Act Directly

SAFE-0228 Governance Checked automatically by the scanner
1

What goes wrong

Critical actions are routed through a timelock for transparency, but the same functions are also callable directly by an admin/owner, defeating the delay users rely on to react to malicious proposals.

2

The vulnerable pattern

proof of concept — how it is exploited
// setFee is callable by both timelock and owner.
// owner skips the 48h delay and sets fee to 100% instantly,
// giving users no window to exit.
3

How to fix it

the pattern that is safe
// the timelock must be the ONLY holder of the admin role
require(msg.sender == address(timelock), "only timelock");
Route ALL privileged calls exclusively through the timelock.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0228 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs