# LibDiamond.diamondCut() should check diamondStorage().acceptanceTimes[keccak256(abi.encode(_diamondCut))] != 0

Diamond cut delay check passes when acceptance time is 0, letting governance execute arbitrary facet changes without the timelock delay.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: GimelSec
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/215
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-04
- Tags: area:web3 domain:web3 impact:privesc kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LibDiamond diamond proxy upgrade/timelock logic
**Root cause:** diamondCut() only checks acceptanceTimes[hash] < block.timestamp; rescindDiamondCut() sets that value to 0, and an unproposed cut also reads 0, both of which satisfy the check.
**Steps:**
1. Call proposeDiamondCut() to set acceptanceTimes[keccak256(abi.encode(_diamondCut))] = block.timestamp + _delay
2. Call rescindDiamondCut() with same _diamondCut, resetting acceptanceTimes[hash] to 0
3. Call diamondCut() with same _diamondCut: require(0 < block.timestamp) passes, executing cut immediately without delay
4. Alternatively call diamondCut() for a cut never proposed: acceptanceTimes defaults to 0 and passes
**How found:** Code reading of LibDiamond propose/rescind/diamondCut functions; noticed rescind zeroes the acceptance time and that the delay check lacks a != 0 guard, so zero trivially satisfies < block.timestamp.
**Exploitation:** A malicious or compromised governance proposes a cut, rescinds it (or never proposes), then executes diamondCut in the same transaction, replacing facets/arbitrary init calldata without waiting the timelock delay.
**Insight:** When a timelock is enforced by comparing a stored timestamp against block.timestamp, a zeroed/unset mapping entry always passes; check for a nonzero sentinel and that the entry was actually proposed.