Submitted by alexweb3, also found by D_Auditor, josephdara, TorpedoPistolIXC41, zaggle, koo, cartlex_, hals, mladenov, Neon2835, Neon2835, lanrebayode77, Silvermist, pep7siup, Musaka, Timenov, Timenov, LuchoLeonel1, mahyar, mrudenko, DedOhWale, adeolu, zaevlad, and DelerRH
The modifiers onlyRole (bytes32 role) and checkRole (bytes32 role) are not implemented correctly. This would allow anybody to call sensitive functions that should be restricted.
For the POC, I set up a new foundry projects and copied the folders lybra, mocks and OFT in the src folder of the new project. I installed the dependencies and then I created a file POCs.t.sol in the test folder. Here is the code that shows a random address can call sensitive functions that should be restricted:
Manual Review
Wrap the 2 function calls in a require statement:
In modifier onlyRole (bytes32 role), instead of GovernanceTimelock.checkOnlyRole (role, msg.sender), it should be something like require (GovernanceTimelock.checkOnlyRole (role, msg.sender), Not Authorized).
The same goes for the checkRole (bytes32 role) modifier.
Access Control
LybraFinance confirmed
