TimelockController vulnerability in OpenZeppelin Contracts

Vulnerability

In OpenZeppelin Contracts versions before 4.3.1 and 3.4.2, the TimelockController contract contains a privilege escalation vulnerability. The _beforeCall function did not verify that the operation was ready before execution, allowing an actor with the EXECUTOR_ROLE to bypass the timelock delay and execute operations prematurely. This affects all deployments using the affected versions. [2][4]

Exploitation

An attacker with the EXECUTOR_ROLE can call execute or executeBatch with an operation that has not yet become ready (i.e., before the timelock delay has elapsed). The missing isOperationReady check in _beforeCall allows the operation to be executed immediately. If the executor role is set to "open" (anyone can assume it), any user can exploit this. [3][4]

Impact

Successful exploitation allows the attacker to reset the timelock delay to zero and escalate privileges, effectively taking full control of the timelock contract. This grants unrestricted access to all assets held in the contract, including tokens and ownership rights. [4]

Mitigation

The fix is included in versions 4.3.1, 3.4.2, and 3.4.2-solc-0.7 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. Deployed instances should be replaced with a fixed version by migrating all assets, ownership, and roles. As a workaround, revoke the executor role from accounts not strictly under the team's control, ensuring at least one proposer and executor remain. [2][4]