Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Quorum can be manipulate to pass proposals hat do not meet it

pyro

Summary

Quorum can be manipulate to pass proposals hat do not meet it.

Vulnerability Details

For a quorum to get executed it first needs to have more FOR than AGAINST votes, but even before that it needs to pass the requiredQuorum, which is a percentage of all votes compared to the total.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/proposals/Governance.sol#L288

function state(uint256 proposalId) public view override returns (ProposalState) {
// ...
​
ProposalVote storage proposalVote = _proposalVotes[proposalId];
uint256 currentQuorum = proposalVote.forVotes + proposalVote.againstVotes;
​
uint256 requiredQuorum = quorum();
​
// If a quorum didn't pass you can withdraw or do anything to lower the `quorum` and execute the TX
// as it would have passed
if (currentQuorum < requiredQuorum || proposalVote.forVotes <= proposalVote.againstVotes) {
return ProposalState.Defeated;
}
​
bytes32 id = _timelock.hashOperationBatch(
proposal.targets,
proposal.values,
proposal.calldatas,
bytes32(0),
proposal.descriptionHash
);

Currently it's 4% from veRAAC's totalSupply.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/proposals/Governance.sol#L353-L355

function quorum() public view override returns (uint256) {
// veToken totalSupply * 4 / 100
return (_veToken.getTotalVotingPower() * quorumNumerator) / QUORUM_DENOMINATOR;
}

However the issue we face here is that a user can vote and after voting reduce the total supply i order for this proposal to pass the quorum.

Example:

  1. Quorum is 20% of totalSupply, where 100k tokens exist

  2. Users vote, and get 55% FOR and 45 AGAINST, however they only have 19k (19%) of the total voting power, so the quorum in not passed

  3. Right after the proposal finished a user or a few withdraw all of their token in order to lower the totalSupply

  4. The new totalSupply is 95k and 19k out of that is 20%

  5. They schedule and execute the proposal

Note that totalSupply can also get lowered with time, just as some users leave the system.

Impact

Malicious proposals that don't meed to quorum can still be executed.
Quorum can be manipulated to pass proposals.

Tools Used

Manual review

Recommendations

Change is not trivial. Consider redesigning the way that votes are taken and counted.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::quorum uses current total voting power instead of proposal creation snapshot, allowing manipulation of threshold requirements to force proposals to pass or fail

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::quorum uses current total voting power instead of proposal creation snapshot, allowing manipulation of threshold requirements to force proposals to pass or fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!