Governor admin can rug the protocol by proposing and executing malicious proposal by himself after the timelock

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-zksync/blob/456078b53a6d09636b84522ac8f3e8049e4e3af5/ethereum/contracts/zksync/facets/DiamondCut.sol#L22
https://github.com/code-423n4/2022-10-zksync/blob/456078b53a6d09636b84522ac8f3e8049e4e3af5/ethereum/contracts/zksync/facets/DiamondCut.sol#L46

Vulnerability details

Impact

Governor admin can rug the protocol by proposing and executing malicious proposal by himself after the timelock

Proof of Concept

There is nothing stop compromised governor admin rug the protocol by proposing and executing malicious proposal by himself after the timelock.

1. the admin can create a malicious proposal and call the function proposeDiamondCut

 function proposeDiamondCut(Diamond.FacetCut[] calldata _facetCuts, address _initAddress) external onlyGovernor {

The malicious proposal can be adding malicious facet and steal user fund.
The malicious proposal can be removing all the diamond facet or freeze all facet.

2. The admin needs to wait UPGRADE_NOTICE_PERIOD, which is 14 days currently beause of the check

bool approvedBySecurityCouncil = s.diamondCutStorage.securityCouncilEmergencyApprovals >=
	SECURITY_COUNCIL_APPROVALS_FOR_EMERGENCY_UPGRADE;

bool upgradeNoticePeriodPassed = block.timestamp >=
	s.diamondCutStorage.proposedDiamondCutTimestamp + UPGRADE_NOTICE_PERIOD;

require(approvedBySecurityCouncil || upgradeNoticePeriodPassed, "a6"); // notice period should expire
require(approvedBySecurityCouncil || !diamondStorage.isFrozen, "f3");
// should not be frozen or should have enough security council approvals

3. the admin does not need the security council to approve the proposal, after the wait UPGRADE_NOTICE_PERIOD, the admin governor can just call:

   function executeDiamondCutProposal(Diamond.DiamondCutData calldata _diamondCut) external onlyGovernor {

to complete executing the malicious proposal.

4. Since only the governor has this power, user and other security council can do nothing if the governor misbehave.

Tools Used

Manual Review

Recommended Mitigation Steps

I think having the governor propose a proposal and requesting at least SECURITY_COUNCIL_APPROVALS_FOR_EMERGENCY_UPGRADE approve from the security council

can make the executing new proposal process more decentralized.

[miladpiri]

Notice period is there to protect any instant upgrade. Moreover, instant upgrade can be executed only by approval of security council members. Not a valid issue!

[c4-sponsor]

miladpiri marked the issue as sponsor disputed

[c4-judge]

GalloDaSballo marked the issue as duplicate of #144

[GalloDaSballo]

L

[c4-judge]

Duplicate of #239