# Eth sent to Timelock will be locked in current implementation

GovernorAlpha.execute lacks payable, so ETH held by the Timelock cannot be paid out via proposals; funds sent to Timelock are locked.

- Payout: Audit contest
- Severity: medium
- Program: OpenLeverage
- Found by: defsec
- Disclosed: 2022-03-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-openleverage-findings/issues/80
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** GovernorAlpha/Timelock governance contracts
**Root cause:** GovernorAlpha.execute is not payable and forwards no value to timelock.executeTransaction, so proposals that pay ETH from the Timelock cannot be executed; any ETH sent to the Timelock is stuck.
**Steps:**
1. Deploy GovernanceAlpha and Timelock
2. Send ETH to the Timelock contract
3. Create proposal via `proxy.propose([signer3],[parseEther('0.1')],[''],[0],'Send funds')`
4. Vote and queue the proposal
5. Call `proxy.execute(2)` — reverts because execute is not payable
6. Call `proxy.execute(2,{value:parseEther('0.1')})` — succeeds but ETH comes from msg.sender, not the Timelock
**How found:** Researcher was experimenting with the governance contracts and noticed execute() was non-payable while proposals could specify ETH values, then tested a 0.1 ETH payout proposal and observed the revert and that value came from msg.sender.
**Exploitation:** No attacker path; the flaw is that legitimate governance payouts from the Timelock fail, and ETH sent to the Timelock is permanently locked since execute cannot forward value.
**Insight:** When auditing Compound-fork governance, check whether GovernorAlpha.execute is payable and forwards proposal.values to timelock.executeTransaction; a non-payable execute silently bricks any ETH-holding Timelock.