# Owner of FraxlendPair can set arbitrary time lock contract address to circumvent time lock

FraxlendPair owner can swap the external time lock contract for an arbitrary address, bypassing the fee-change delay and letting protocol fees change instantly.

- Payout: Contest reward
- Severity: medium
- Program: Frax Finance
- Credited: berndartmueller
- Disclosed: 2023-01-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-frax-findings/issues/156
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-08
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** FraxlendPair lending pair contract (Solidity)
**Root cause:** setTimeLock is onlyOwner and accepts any address, so the trusted owner can point TIME_LOCK_ADDRESS at a contract that imposes no delay, defeating the timelock enforced on changeFee.
**Steps:**
1. Deploy FraxlendPair; ownership goes to COMPTROLLER_ADDRESS via FraxlendPairDeployer_deploySecond.
2. Owner calls `setTimeLock(attackerControlledContract)` where the contract returns immediately with no delay.
3. Owner calls `changeFee(newFee)`; the timelock check against the fake contract passes instantly.
4. Protocol fee is changed without the intended waiting period, users unaware.
**How found:** Code review of setTimeLock and changeFee: noticed the timelock is an external, owner-settable address rather than an in-contract delay, making the enforcement trust-dependent.
**Exploitation:** Trusted owner replaces the timelock contract with a no-delay implementation, then immediately invokes changeFee to alter protocol fees before users can react.
**Insight:** When a timelock is an external contract address that an owner can reassign, the delay is only as strong as that owner; check whether delay logic is internal and immutable rather than a swappable dependency.