Excessive privilege for Timelock governor

[code423n4]

Handle

gzeon

Vulnerability details

Impact

Timelock governor can change delay and gracePeriod at will, which render the timelock useless.

https://github.com/code-423n4/2021-11-malt/blob/c3a204a2c0f7c653c6c2dda9f4563fd1dc1cecf3/src/contracts/Timelock.sol#L68

  function setDelay(uint256 _delay)
    public
    onlyRole(GOVERNOR_ROLE, "Must have timelock role")

function setGracePeriod(uint256 _gracePeriod)
    public
    onlyRole(GOVERNOR_ROLE, "Must have timelock role")

Recommended Mitigation Steps

Make delay and gracePeriod constant, when change is needed deploy a new timelock and transfer ownership.

[0xScotch]

#263

[GalloDaSballo]

Bumping up to high severity

[GalloDaSballo]

Duplicate of #263