Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect cancel proposal logic implementation

0xbc000

Summary

In file contracts/core/governance/proposals/Governance.sol line 245

The only proposer OR if proposer's voting power dropped below threshold's logic is using the and && operator

/**
* @notice Cancels an active proposal
* @dev Allows cancellation by proposer or if proposer's voting power drops below threshold
* - Only cancellable before execution
* - Proposer can always cancel their proposal
* - Automatic cancellation if proposer loses required voting power
* @param proposalId The ID of the proposal to cancel
*/
function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
ProposalState currentState = state(proposalId);
if (currentState == ProposalState.Executed) {
revert InvalidProposalState(proposalId, currentState, ProposalState.Active, "Cannot cancel executed proposal");
}
​
// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer &&
(p_veToken.getVotingPowerroposal.proposer) >= proposalThreshold) {
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
​
proposal.canceled = true;
emit ProposalCanceled(proposalId, msg.sender, "Proposal canceled by proposer");
}

Vulnerability Details

This logic implementation could cause anyone can cancel an active propersal

Impact

Unauthorized cancel a propersal

Tools Used

Manual review

Recommendations

Change the && operator to ||

// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer || // <- OR here
(p_veToken.getVotingPowerroposal.proposer) >= proposalThreshold) {
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.