Core Contracts

Summary

Arbitrarily canceling unexecuted proposals

Vulnerability Details

In cancel(), if the caller is not the proposal creator, the cancellation is only rejected if the proposal creator's voting power is still ≥ proposalThreshold.
This means that once the proposal creator's voting power drops below proposalThreshold, anyone can call cancel() to cancel the proposal.

Consider this scenario:

1. Assume proposalThreshold is 100,000 veRAAC.
   The proposal creator, A, held 150,000 veRAAC at the time of proposal creation and successfully called propose() to create the proposal.

2. After the proposal is created, A's veRAAC holdings may decrease to 80,000 veRAAC due to selling or other reasons, falling below the proposalThreshold.

3. Any user other than A can call cancel() to cancel the proposal.