Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Proposal Voting Power Issue

udo

Summary

This report highlights a critical issue in the proposal governance contract where a proposer’s voting power is not guaranteed to remain above the proposalThreshold after a proposal has been created. The contract currently allows cancellation of proposals only if the proposer's voting power drops below the threshold at the time of cancellation. However, there is no mechanism to enforce that a proposer maintains the required voting power throughout the proposal's lifecycle.

Issue Description

Finding: Proposer’s Voting Power Can Drop Below Threshold After Proposal Creation :

function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
ProposalState currentState = state(proposalId);
if (currentState == ProposalState.Executed) {
revert InvalidProposalState(proposalId, currentState, ProposalState.Active, "Cannot cancel executed proposal");
}
​
// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer &&
_veToken.getVotingPower(proposal.proposer) >= proposalThreshold) {
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
​
proposal.canceled = true;
emit ProposalCanceled(proposalId, msg.sender, "Proposal canceled by proposer");
}
​

Root Cause Analysis

  • The proposal is created based on the proposer’s voting power at that moment.

  • The contract does not store the proposer's voting power at the time of creation.

  • The proposer's voting power could decrease below proposalThreshold before the proposal is executed, making them ineligible under normal circumstances.

  • However, the contract only checks the proposer’s voting power at the time of cancellation, not during the proposal’s lifecycle.

Potential Exploit Scenario

  1. A proposer meets the voting power threshold and creates a proposal.

  2. The proposer transfers or delegates their tokens, reducing their voting power below proposalThreshold.

  3. The proposal remains active and can be voted on, even though the proposer would no longer qualify to create one.

Recommendations

Store Initial Voting Power at Proposal Creation

Modify the proposal creation function to store the proposer’s voting power at that time.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!