Summary

The protection of GovernorPreventLateQuorum against whales influencing the result by voting in the last minute.

Vulnerability Details

According to the docs of GovernorPreventLateQuorum, the purpose of the module is:

This works fine with nominal votes, where a large voter would have to cast their whole vote to a particular decision and the other voters would therefore still have time to react. However, the custom GovernorCountingFractional module supports partial voting, which makes this protection ineffective. A large voter can vote with a small part of their weight against their intention such that quorum is reached. The vote will then be extended. Just before the extension is over, they can vote with the rest of their weight for their original intention, leaving no time for anyone to react.

Impact

Let's assume there is a large voter with 30% of the overall weight. The quorum is set to 50% of the overall weight. There is a controversial proposal that has reached 35% NO and 14% YES. The large voter now votes with 1% for NO to trigger the quorum and the vote extension starts. Everyone in support of NO (e.g. the ZKSync foundation) is relieved and does not mobilize more voters, as the quorum was reached and they are in the majority by a large margin. 1 second before the vote extension ends, the large voter casts their remaining 29% for YES, resulting in 43% YES and 36% NO, meaning the vote succeeded (https://github.com/Cyfrin/2024-10-zksync/blob/b0c5565b6078a93cc3358a5d5012258caa701385/zk-governance/l2-contracts/src/lib/GovernorCountingFractional.sol#L104).

Note that such sophisticated governance attacks are very realistic, which is e.g. highlighted by this paper: https://dl.acm.org/doi/10.1145/3605768.3623539

Recommendations

In combination with GovernorCountingFractional, a more sophisticated protection mechanism is needed. One possibility is to not only consider if the quorum was reached, but additionally if the result (i.e. _voteSucceeded) changes in the extension period. In such cases, there should be another extension.