Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: medium
Valid

Queued proposals still be canceled and executed

Summary

Proposal creator can cancel already passed and queued proposals. When a proposal is canceled, Governor contract doesn't cancel TimelockController's batch.

Vulnerability Details

function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
ProposalState currentState = state(proposalId);
@> if (currentState == ProposalState.Executed) { // @audit Queued and successful proposals can still be canceled
revert InvalidProposalState(proposalId, currentState, ProposalState.Active, "Cannot cancel executed proposal");
}
// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer &&
_veToken.getVotingPower(proposal.proposer) >= proposalThreshold) {
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
@> proposal.canceled = true; // @audit Governance doesn't call TimelockController.cancel function
emit ProposalCanceled(proposalId, msg.sender, "Proposal canceled by proposer");
}

Impact

Queued proposals can be canceled by proposer. In this case, canceled proposal batch still lives in TimelockController, and it can be executed by any user who has EXECTOR role

Recommendation

  • Don't allow queued proposals to be canceled

  • Call TimelockController.cancel when a proposal is canceled.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

Governance::cancel and state lack synchronization with TimelockController

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

Governance::cancel and state lack synchronization with TimelockController

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!