Reproduced Exploit
Timelock.admin takeover through a regular proposal — governance privilege escalation
The audited Governor path lets an ordinary proposal call the Timelock's privileged setPendingAdmin. The reduction records an attacker-controlled pending administrator when that transaction is included and executed.
Loss
Governance administration can be seized by a proposal author
Chain
Ethereum
Category
governance
Date
Jan 2021
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori. Standalone Foundry PoC and full write-up: 18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori_exp in the
evm-hack-registrymirror.
Vulnerability classes: vuln/governance/proposal-manipulation · vuln/access-control/missing-owner-check
Reproduction: self-contained synthetic Foundry reduction; see output.txt.
Key info#
| Field | Value |
|---|---|
| Loss | Governance administration can be seized by a proposal author |
| Vulnerable contract | Governor proposal execution / Timelock |
| Attacker EOA | 0x1111111111111111111111111111111111111111 |
| Attack contract | Exploit (local synthetic reduction) |
| Attack tx | Exploit.run() |
| Chain / block / date | Ethereum model · block 0 · 2021-01 |
| Compiler | solc 0.8.24 (synthetic) |
| Bug class | Unrestricted proposal target for setPendingAdmin |
TL;DR#
The audited Governor path lets an ordinary proposal call the Timelock's privileged setPendingAdmin. The reduction records an attacker-controlled pending administrator when that transaction is included and executed.
Background#
Origin Dollar used a Governor plus Timelock split. The guardian had a special pending-admin queue, but regular proposal execution did not exclude the same target. This is an AuditVault report, not a claim of a historical on-chain exploit.
The vulnerable code#
// Synthetic reduction in test/18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori.sol
pendingAdmin = msg.sender; // @> proposal target is not restricted
Root cause#
Proposal execution accepts a privileged administrative selector without checking that only the dedicated guardian/timelock path may invoke it.
Preconditions#
- A proposal can be created and queued.
- Governance executes the proposal without filtering the Timelock-admin target.
Attack walkthrough#
Exploit.run()represents a proposal containingsetPendingAdmin.- The vulnerable operation assigns
pendingAdminto the proposal caller. - The
Proofevent at output.txt:361 records the takeover.
Diagrams#
Remediation#
Reject setPendingAdmin in ordinary proposals, or make Governor inherit the Timelock authorization and retain one canonical admin queue.
How to reproduce#
cd evm-hack-registry/18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori_exp
forge test -vvvvv
Sources#
Reference: https://github.com/trailofbits/publications/blob/master/reviews/OriginDollar.pdf
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori_exp (evm-hack-registry mirror).
- AuditVault finding: 18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.