Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`Governance::cancel` allows any user to cancel valid proposals and block governance functionalities

77SecMentees

Summary

RAAC has a Governance mechanism that enables veRAAC holders to create and vote on proposals, manage protocol parameters through governance, implement secure timelock execution for proposals, and track proposal states and voting results. This is done through the propose, castVote, executeand cancel functions.

Vulnerability Details

The problem relies on the Governance::cancellogic in which a wrong check is implemented allowing valid proposals and proposers to be canceled when the proposer has voting power above the threshold and not above as it should be, following documentation.

// Only proposer or if proposer's voting power dropped below threshold
- if (msg.sender != proposal.proposer && _veToken.getVotingPower(proposal.proposer) >= proposalThreshold) {
​
revert InsufficientProposerVotes(proposal.proposer, _veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}

Impact

Protocol can be attacked and the proposal system will be halted by malicious users. Because any wallet can call the Governance::cancelfunction.

Tools Used

Code Review

Recommendations

Adjust the conditional to allow cancelations of proposals in which the proposer's voting power has dropped.

- if (msg.sender != proposal.proposer && _veToken.getVotingPower(proposal.proposer) >= proposalThreshold) {
+ if (msg.sender != proposal.proposer && _veToken.getVotingPower(proposal.proposer) < proposalThreshold) {
​
revert InsufficientProposerVotes(proposal.proposer, _veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!