Submission Details
Severity:
Lack of proposal rate limits allows eligible proposers to spam unlimited proposals
Description
The Governance contract does not implement any mechanism to limit the number of proposals a proposer can submit within a given time period. As a result, any eligible proposer can spam numerous malicious proposals to increase the likelihood of evading cancellation.
// https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/proposals/Governance.sol#L127-L168
function propose(
address[] memory targets,
uint256[] memory values,
bytes[] memory calldatas,
string memory description,
ProposalType proposalType
) external override returns (uint256) { ... }
Recommendations
Limit the number of proposals each proposer can submit within a fixed time period, e.g., a maximum of 3 proposals per day or even 1 proposal per day
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.