# Some setters' timelock can be bypassed

Golom's setter timelocks can be bypassed: setting a privileged address to zero then re-setting it skips the 1-day delay, letting the owner swap minters/distributors instantly.

- Payout: Contest reward
- Severity: medium
- Program: Golom
- Credited: zzzitron
- Disclosed: 2023-04-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-golom-findings/issues/698
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AM-12
- Tags: domain:web3 impact:privesc kind:contest platform:code4rena sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity governance contracts (GolomToken, GolomTrader, RewardDistributor)
**Root cause:** setDistributor/setMinter only apply the timelock when the current value is non-zero; when it is zero the new value is set immediately, and executeSet* lacks a check that a pending value exists.
**Steps:**
1. Call `setDistributor(0)` (or `setMinter(0)`) and wait out the timelock, then `executeSetDistributor()` to zero the slot.
2. Now call `setDistributor(newAddr)` — since current distributor is address(0), it is set immediately with no timelock.
3. Repeat: alternate execute-to-zero and set-to-new to keep bypassing the delay.
4. For GolomToken: `setMinter(0)`, wait timelock, `executeSetMinter()`, then `setMinter(any)` + `executeSetMinter()` with no delay.
**How found:** Code reading of the setter/execute pairs revealed the timelock branch is conditional on the current address being non-zero, and execute functions don't require a pending value.
**Exploitation:** Owner (or compromised owner key) zeroes the privileged slot via the execute function, then sets an arbitrary new minter/distributor instantly, defeating the notice period meant to let users react.
**Insight:** When auditing timelock patterns, check whether the delay branch is conditional on current state (e.g. non-zero) and whether execute functions require a pending value — a zero-address reset can collapse the delay to instant.