fix(R-I-18): reject proposals with deadline shorter than the timelock by sh3ifu · Pull Request #51 · UTEXO-Protocol/bridge-smart-contracts

sh3ifu · 2026-06-12T14:40:22Z

R-I-18 — proposal deadline shorter than timelock is dead on arrival

_propose only bounded deadline from above. A proposal created with
deadline < block.timestamp + timelockDuration can never execute:
executeProposal reverts TimelockActive while the timelock runs, and once it
elapses block.timestamp > deadline so it reverts ProposalExpired. The
proposal still consumes a proposalNonce and burns a federation signing round.

Fix

Add a lower bound in _propose:

if (deadline < block.timestamp + timelockDuration) revert DeadlineBeforeTimelock();

) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

…ns (#49) * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions * fix(R-I-18): reject proposals with deadline shorter than the timelock (#51) * fix(R-I-18): reject proposals with deadline shorter than the timelock * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions (#52) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

…INE (#48) * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions (#49) * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions * fix(R-I-18): reject proposals with deadline shorter than the timelock (#51) * fix(R-I-18): reject proposals with deadline shorter than the timelock * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions (#52) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

…ts (#47) * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE (#48) * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions (#49) * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions * fix(R-I-18): reject proposals with deadline shorter than the timelock (#51) * fix(R-I-18): reject proposals with deadline shorter than the timelock * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions (#52) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

…ns (#46) * test(R-I-07,R-I-08): min fundsIn amount + zero-amount guard regressions * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts (#47) * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE (#48) * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions (#49) * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions * fix(R-I-18): reject proposals with deadline shorter than the timelock (#51) * fix(R-I-18): reject proposals with deadline shorter than the timelock * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions (#52) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

…mount fundsOut guard (#45) * fix(R-I-07,R-I-08): enforce a non-zero minimum fundsIn amount; zero-amount fundsOut guard * test(R-I-07,R-I-08): min fundsIn amount + zero-amount guard regressions (#46) * test(R-I-07,R-I-08): min fundsIn amount + zero-amount guard regressions * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts (#47) * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE (#48) * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions (#49) * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions * fix(R-I-18): reject proposals with deadline shorter than the timelock (#51) * fix(R-I-18): reject proposals with deadline shorter than the timelock * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions (#52) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

#44) * test(R-W-03): fee-shape invariant regression for CommissionManager setters * fix(R-I-07,R-I-08): enforce a non-zero minimum fundsIn amount; zero-amount fundsOut guard (#45) * fix(R-I-07,R-I-08): enforce a non-zero minimum fundsIn amount; zero-amount fundsOut guard * test(R-I-07,R-I-08): min fundsIn amount + zero-amount guard regressions (#46) * test(R-I-07,R-I-08): min fundsIn amount + zero-amount guard regressions * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts (#47) * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE (#48) * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions (#49) * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions * fix(R-I-18): reject proposals with deadline shorter than the timelock (#51) * fix(R-I-18): reject proposals with deadline shorter than the timelock * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions (#52) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

… time (#43) * fix(R-W-03): reject stablePercent > multiplier^2 at commission config time * test(R-W-03): fee-shape invariant regression for CommissionManager se… (#44) * test(R-W-03): fee-shape invariant regression for CommissionManager setters * fix(R-I-07,R-I-08): enforce a non-zero minimum fundsIn amount; zero-amount fundsOut guard (#45) * fix(R-I-07,R-I-08): enforce a non-zero minimum fundsIn amount; zero-amount fundsOut guard * test(R-I-07,R-I-08): min fundsIn amount + zero-amount guard regressions (#46) * test(R-I-07,R-I-08): min fundsIn amount + zero-amount guard regressions * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts (#47) * chore(R-I-07,R-I-08): pass minFundsInAmount to Bridge in deploy scripts * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE (#48) * fix(R-I-01): bound TEE execute/executeBatch deadline to MAX_TEE_DEADLINE * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions (#49) * test(R-I-01): TEE execute/executeBatch deadline upper-bound regressions * fix(R-I-18): reject proposals with deadline shorter than the timelock (#51) * fix(R-I-18): reject proposals with deadline shorter than the timelock * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions (#52) * test(R-I-18): proposal deadline-vs-timelock lower-bound regressions * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge (#55) * fix(R-I-11): cap destinationAddress / sourceAddress length in Bridge * test(R-I-11): destinationAddress / sourceAddress length-cap regressions (#56) * test(R-I-11): destinationAddress / sourceAddress length-cap regressions * fix(R-I-12): cap proof length in Bridge.fundsOut (#57) * fix(R-I-12): cap proof length in Bridge.fundsOut * test(R-I-12): proof length-cap regressions for fundsOut (#58) * test(R-I-12): proof length-cap regressions for fundsOut * fix(R-W-12): enforce strict-majority signer threshold floor (#60) * fix(R-W-12): enforce strict-majority signer threshold floor * test(R-W-12): strict-majority signer threshold regressions (#61) * test(R-W-12): strict-majority signer threshold regressions * fix(R-W-14): require disjoint enclave and federation signer sets (#62) * fix(R-W-14): require disjoint enclave and federation signer sets * test(R-W-14): disjoint signer-set regressions (#63) * test(R-W-14): disjoint signer-set regressions * fix(R-I-06): cap signer-set size at MAX_SIGNERS (#64) * fix(R-I-06): cap signer-set size at MAX_SIGNERS * test(R-I-06): signer-set size cap regressions (#65)

fix(R-I-18): reject proposals with deadline shorter than the timelock

361d6a2

crawter approved these changes Jun 17, 2026

View reviewed changes

sh3ifu merged commit 0001b2d into multisig-R-I-01-tee-deadline-upper-bound-tests Jun 17, 2026
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(R-I-18): reject proposals with deadline shorter than the timelock#51

fix(R-I-18): reject proposals with deadline shorter than the timelock#51
sh3ifu merged 2 commits into
multisig-R-I-01-tee-deadline-upper-bound-testsfrom
multisig-R-I-18-proposal-deadline-vs-timelock-fix

sh3ifu commented Jun 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sh3ifu commented Jun 12, 2026

R-I-18 — proposal deadline shorter than timelock is dead on arrival

Fix

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants