Requirement for having timelocks on recovery transactions is not enforceable

Lines of code Vulnerability details Impact When calling the following AmbireAccount.execute function with sigMode being SIGMODERECOVER, a recovery transaction can be scheduled if requireprivilegessignerKeyToRecover == recoveryInfoHash, 'RECOVERYNOTAUTHORIZED' and requireisIn,...

execute() replay RECOVER after cancel

Lines of code Vulnerability details Impact Maliciously replay a recover transaction that has been cancelled and execute it Proof of Concept The user can cancel the transactions already in scheduledRecoveries by using SIGMODECANCEL. The code is as follows: function executeTransaction calldata txns...