[BRA-02M] Insufficient Validation of Period Configurations

[Haypierre]

BRA-02M: Insufficient Validation of Period Configurations

Type	Severity	Location
Input Sanitization		BaseRecoverableAccount.sol:L100

Description:

The system validates some of the period and window configurations but fails to mandate that the security period is less than the security window.

Impact:

The system can presently be configured with a security period greater than the security window which would contradict the guardian management function implementations.

Example:

/*
 * @notice Initialize the smart contract account.
 */
function initialize(
    address _defaultAdmin,
    uint256 _recoveryPeriod,
    uint256 _securityPeriod,
    uint256 _securityWindow,
    uint256 _lockPeriod,
    address _initialGuardian
) public initializer {
    if (_defaultAdmin == address(0)) {
        revert ZeroAddressNotAllowed();
    }
    if (_lockPeriod < _recoveryPeriod || _recoveryPeriod < _securityPeriod + _securityWindow) {
        revert InsecurePeriod();
    }
    __Ownable2Step_init();
    _transferOwnership(_defaultAdmin);
    __EIP712_init("Openfort", "0.5");

    recoveryPeriod = _recoveryPeriod;
    lockPeriod = _lockPeriod;
    securityWindow = _securityWindow;
    securityPeriod = _securityPeriod;

    if (_initialGuardian != address(0)) {
        guardiansConfig.guardians.push(_initialGuardian);
        guardiansConfig.info[_initialGuardian].exists = true;
        guardiansConfig.info[_initialGuardian].index = 0;
        guardiansConfig.info[_initialGuardian].pending = 0;
        emit GuardianAdded(_initialGuardian);
    }
}

Recommendation:

We advise such validation to be imposed, ensuring that the system cannot be misconfigured.

[Haypierre]

Security Period is expected to be greater than Security Window:

        const RECOVERY_PERIOD = 2 * 24 * 60 * 60 // 2 days in seconds
        const SECURITY_PERIOD = 1.5 * 24 * 60 * 60 // 1.5 days in seconds
        const SECURITY_WINDOW = 0.5 * 24 * 60 * 60 // 0.5 days in seconds
        const LOCK_PERIOD = 5 * 24 * 60 * 60 // 5 days in seconds

see tasks/deployFactory.ts.