Core Contracts

Summary

The setParameter function in the governance contract allows the contract owner to modify critical governance parameters, such as VotingDelay, VotingPeriod and QuorumNumerator. However, the current implementation lacks safeguards to ensure that these changes apply only to future proposals and not to existing ones. This oversight introduces a significant vulnerability, as it enables retroactive manipulation of governance rules, undermining the fairness, predictability, and trustworthiness of the governance process.

For example:

• Increasing the VotingDelay or VotingPeriod could delay voting on existing proposals, frustrating participants and potentially stalling decision-making.

• Adjusting the QuorumNumerator could make it harder or easier for ongoing proposals to meet quorum requirements, enabling manipulation of voting outcomes.

Vulnerability Details

The vulnerability lies in the setParameter function, which updates governance parameters without distinguishing between new proposals and existing proposals. As a result, changes to parameters like VotingDelay, VotingPeriod and QuorumNumerator apply retroactively to all proposals, including those already in progress. This creates the following risks:

1. Delayed Voting: Increasing VotingDelay or VotingPeriod for existing proposals could delay decision-making, frustrating participants and potentially causing proposals to lose relevance over time.

2. Quorum Manipulation: Changing the QuorumNumerator could make it harder or easier for ongoing proposals to meet quorum requirements, enabling the owner to influence voting outcomes.

Impact

• Unfair Outcomes: Changes to parameters like QuorumNumerator could unfairly influence voting outcomes or restrict participation.

• Delayed Decision-Making: Increasing VotingDelay or VotingPeriod could stall the governance process, causing frustration and reducing engagement.

Tools Used

Manual Review

Recommendations

To address this vulnerability, governance parameters should be immutable for proposals once they are submitted.