0x52 - Timelock is expected to be able to send ETH but doesn't have any payable functions to receive ETH

[sherlock-admin]

0x52

medium

Timelock is expected to be able to send ETH but doesn't have any payable functions to receive ETH

Summary

TimeLock#execute sends a message value when it calls target. The issue is there is no way for the contract to have any ETH because it doesn't contain any payable functions.

Vulnerability Detail

TimeLock.sol#L113-L116

    (bool ok, bytes memory res) = _target.call{value: _value}(data);
    if (!ok) {
        revert TxFailedError(_func);
    }

When making the call to target it includes a _value which can be specified in the function calldata. The contract, however has no way to receive ETH besides a forced self destruct call. Notably it is also missing a receive or fallback function and none of it's other functions are payable.

Impact

Timelock is expected to be send/receive ETH but can't

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/TimeLock.sol#L74-L121

Tool used

Manual Review

Recommendation

Add a payable receive

Duplicate of #387