Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users can manipulate the governance

pyro

Summary

Users can manipulate the governance

Vulnerability Details

castVote takes the bias at the user getVotingPower at the time of calling the function:

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/proposals/Governance.sol#L181

function castVote(uint256 proposalId, bool support) external override returns (uint256) {
// ...
​
// We get current voting power and not one at or before proposal creation
// meaning that users can manipulate this vote
uint256 weight = _veToken.getVotingPower(msg.sender);
if (weight == 0) {
revert NoVotingPower(msg.sender, block.number);
}

Where the voting power is his bias.

function getVotingPower(address account) public view returns (uint256) {
return _votingState.getCurrentPower(account, block.timestamp);
}

That is governance 101. Always take snapshots of before the vote even started and use those.

Impact

Because we don't do that if users chose they can mint tokens now and vote, which will significantly alter the results.
If users don't like where the vote is heading they can instantly stake tokens and vote.
Vulnerability is breaking core governance concepts allowing for more easier manipulation.

Tools Used

Manual review.

Recommendations

Get a checkpoint from before the vote started.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance.castVote uses current voting power instead of proposal creation snapshot, enabling vote manipulation through token transfers and potential double-voting

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance.castVote uses current voting power instead of proposal creation snapshot, enabling vote manipulation through token transfers and potential double-voting

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!