TimelockController vulnerability in OpenZeppelin Contracts

Vulnerability

Affected versions of OpenZeppelin Contracts (before 4.3.1) contain a vulnerability in the TimelockController contract that allows an actor with the EXECUTOR_ROLE to escalate privileges. The bug is in the execute and executeBatch functions, which call _beforeCall without verifying that the operation is in the ready state, enabling bypass of the timelock delay. This is fixed by adding an isOperationReady check in _beforeCall [4].

Exploitation

An attacker who holds the EXECUTOR_ROLE (e.g., a malicious executor) can call execute or executeBatch directly, skipping the timelock delay. The _beforeCall function previously only checked the predecessor, not the operation readiness. The attacker can thus execute operations that have not been scheduled or after cancellation, effectively gaining control of the timelocked actions [2].

Impact

Successful exploitation leads to privilege escalation within the TimelockController; an executor can perform actions that should require proposer or admin privileges, potentially taking over the contract's governance. The confidentiality, integrity, and availability of the system can be compromised as the attacker can execute arbitrary operations approved by the timelock [2].

Mitigation

The issue is fixed in OpenZeppelin Contracts version 4.3.1. Users should upgrade to this version or later. If immediate upgrade is not possible, revoke the EXECUTOR_ROLE from accounts not strictly under your control, ensuring there is at least one proposer and executor remaining [2]. No other workarounds are disclosed.