Submission Details
Severity:
Queued proposals still be canceled and executed
Summary
Proposal creator can cancel already passed and queued proposals. When a proposal is canceled, Governor contract doesn't cancel TimelockController's batch.
Vulnerability Details
function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
ProposalState currentState = state(proposalId);
@> if (currentState == ProposalState.Executed) { // @audit Queued and successful proposals can still be canceled
revert InvalidProposalState(proposalId, currentState, ProposalState.Active, "Cannot cancel executed proposal");
}
// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer &&
_veToken.getVotingPower(proposal.proposer) >= proposalThreshold) {
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
@> proposal.canceled = true; // @audit Governance doesn't call TimelockController.cancel function
emit ProposalCanceled(proposalId, msg.sender, "Proposal canceled by proposer");
}
Impact
Queued proposals can be canceled by proposer. In this case, canceled proposal batch still lives in TimelockController, and it can be executed by any user who has EXECTOR role
Recommendation
Don't allow queued proposals to be canceled
Call
TimelockController.cancelwhen a proposal is canceled.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions
Governance::cancel and state lack synchronization with TimelockController
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions
Governance::cancel and state lack synchronization with TimelockController
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.