# Timelock can be bypassed

Timelock's setGovernor and setDelay are callable by the governor directly, letting it swap itself and zero the delay to mint unlimited MALT instantly.

- Payout: Audit contest
- Severity: high
- Program: Malt Finance
- Found by: WatchPug
- Disclosed: 2022-02-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/263
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:governance

**Target:** Timelock.sol governance contract
**Root cause:** setGovernor and setDelay are guarded by onlyRole(GOVERNOR_ROLE) rather than requiring msg.sender == address(this), so the governor can change itself and the delay immediately instead of only through a queued timelock transaction.
**Steps:**
1. Governor calls `Timelock#setGovernor(newGovernor)` — role swaps immediately, no delay.
2. New governor calls `Timelock#setDelay(0)` — passes require since 0 < gracePeriod.
3. New governor now executes privileged txs with zero delay, e.g. grant minter role and mint unlimited MALT.
**How found:** Code review of Timelock access control: noticed setGovernor/setDelay use onlyRole(GOVERNOR_ROLE) instead of self-call restriction, meaning the guarded party can rewrite its own constraints.
**Exploitation:** A compromised or malicious governor key calls setGovernor to install an attacker-controlled address, which then calls setDelay(0), removing all timelock constraints and enabling immediate privileged actions such as minting unlimited MALT.
**Escalation:** Chains governor swap into delay-zeroing to fully neutralize the timelock's security guarantee, then abuses minter privileges for unlimited minting.
**Insight:** In timelock/admin contracts, check whether the privileged role can modify its own role assignment or the delay parameter directly — any admin function not gated by msg.sender == address(this) defeats the timelock.