Core Contracts

Summary

The proposalPowerSnapshots mapping is never initialized or updated. This mapping is used in the getVotingPowerForProposal function to retrieve the voting power of an account at a specific proposal's snapshot block. However, since the mapping is never set, the function will always revert with InvalidProposal(), rendering it unusable. This issue affects the governance functionality of the protocol, as users cannot retrieve their voting power for proposals.

Vulnerability Details

The proposalPowerSnapshots mapping is intended to store the block number at which a proposal's voting power snapshot is taken. This snapshot is used to determine the voting power of users at the time of the proposal's creation. However, the mapping is never updated in the contract, meaning all entries remain uninitialized (i.e., 0).

In the getVotingPowerForProposal function, the following check is performed:

Since proposalPowerSnapshots[proposalId] is always 0, the function will always revert, making it impossible to retrieve voting power for any proposal.

• The proposalPowerSnapshots mapping is never initialized or updated.

• The getVotingPowerForProposal function relies on this mapping to retrieve the snapshot block for a proposal.

• Since the mapping is never set, the function always reverts, breaking the governance functionality.

Impact

• Users cannot retrieve their voting power for proposals, which may prevent them from participating in governance decisions.

• The getVotingPowerForProposal function is rendered unusable.

Tools Used

Manual Review

Recommendations

To address this issue, the following steps should be taken:

1. Initialize proposalPowerSnapshots: Add a function to set the snapshot block for a proposal when it is created.

2. Update Governance Logic: Ensure that the governance module calls this function to initialize the snapshot block for each new proposal.

When a new proposal is created, the governance module should call setProposalSnapshot to initialize the snapshot block: