bin2chen - TimeLock cannot execute transaction with value

[sherlock-admin]

bin2chen

medium

TimeLock cannot execute transaction with value

Summary

TimeLock lacks the payable method and cannot execute transactions with value

Vulnerability Detail

In the TimeLock contract, we can specify the value on the transaction, mainly implemented in queue() and execute(), these two methods are defined as follows:

    function queue(
        address _target,
        uint256 _value,
        string calldata _func,
        bytes calldata _data,
        uint256 _timestamp
    ) external onlyOwner {
...

    function execute(
        address _target,
        uint256 _value,
        string calldata _func,
        bytes calldata _data,
        uint256 _timestamp
    ) external onlyOwner returns (bytes memory) {
....

We can see that these two methods are not with payable

and this contract is also no receive() payable or fallback() payable or other methods with payable

so this contract is unable to accept value (eth)

as a result, if a queue transaction specifies a value, it cannot be executed.

Suggestion: Add a receive() external payable to the contract or execute() to add a payable modifier

Impact

cannot execute transactions with value

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/TimeLock.sol#L74-L80

Tool used

Manual Review

Recommendation

Add a receive() external payable to the contract or execute() to add a payable modifier

Duplicate of #387