KatanaGovernance::_isAuthorized function allows user to perform action even after expiry time has passed.

[howlbot-integration]

Lines of code

https://github.com/ronin-chain/katana-operation-contracts/blob/27f9d28e00958bf3494fa405a8a5acdcd5ecdc5d/src/governance/KatanaGovernance.sol#L375-L381

Vulnerability details

Proof of Concept

If current block time is greater than expiry time then _isAuthorized function returns true.
This logic allow users to perform action even after the expiry time has ended which could allow users to perform unauthorized actions and make project unstable and.

Recommended Mitigation Steps

/**
   * @dev Checks if an account is authorized.
   * @param account The address of the account to check authorization for.
   * @return A boolean indicating whether the account is authorized or not.
   */
  function _isAuthorized(Permission storage $, address account) private view returns (bool) {
    uint256 expiry = $.whitelistUntil;
    if (expiry == UNAUTHORIZED) return false;
    // if (expiry == AUTHORIZED || block.timestamp > expiry) return true;
    if (expiry == AUTHORIZED || block.timestamp < expiry) return true;

    return $.allowed[account];
  }

Assessed type

Access Control

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid