Emergency Withdraw in veRAACToken Breaks Governance Security
Summary
Governance proposals can be created, voted, and executed during an emergency withdrawal period in veRAACToken, allowing manipulation of voting decisions when voting power calculations are unreliable.
Vulnerability Details
In Governance, there is no check in propose(),castVote() and execute() for emergency state in veRAACToken.
During those periods, it's expected that something is going wrong with the Governance. Still a user can propose castVote and execute, when the voting power is unstable.
All governance action should be disabled during an emergency state.
Impact
Governance can be manipulated during emergency periods and Core protocol decisions are at risk.
Depending on the power of the Governance, if it's the owner of several critical contracts, it could end in the Treasury being siphoned or added critical roles to external addres that would mint or burn tokens in the protocols.
Tools Used
Manual
Recommendations
Avoid any Governance action during an Emergency withdrawal event.
Lead Judging Commences
Governance proposals can be created, voted on, and executed during veRAACToken emergency withdrawal periods, allowing manipulation when voting power is inconsistent
Governance proposals can be created, voted on, and executed during veRAACToken emergency withdrawal periods, allowing manipulation when voting power is inconsistent
Appeal created
Governance proposals can be created, voted on, and executed during veRAACToken emergency withdrawal periods, allowing manipulation when voting power is inconsistent
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.