Timelock and events for governor functions

[code423n4]

Handle

pauliax

Vulnerability details

Impact

There are contracts that contain functions that change important parameters of the system, e.g. OverlayV1Mothership has setOVL, initializeMarket, disableMarket, enableMarket, initializeCollateral, enableCollateral, disableCollateral, adjustGlobalParams. None of these functions emit events, nor they are timelocked. Usually, it is a good practice to give time for users to react and adjust to changes.

A similar issue was submitted in a previous contest and assigned a severity of Medium: code-423n4/2021-09-swivel-findings#101

Recommended Mitigation Steps

Consider using a timelock for critical params of the system and emitting events to inform the outside world.

[mesozoic-technology]

The plan has been to have a timelock at some point in the protocol. Probably on whatever is the admin for the mothership. But this just had to be evaluated. It might be on the market contract itself, or on the addresses granted the role of admin.

[mikeyrf]

duplicate #64

[dmvt]

I'm removing the duplicate in this case because issue #64 refers exclusively to the events. This issue is focused primarily on the lack of governance timelock, which has traditionally been considered a medium severity issue.