Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Proposal could be marked as canceled, even if it has status Queued

sovaslava

Summary

In Governance contract, proposal could be marked as canceled, even if this proposal already in timelock contract now.

Vulnerability Details

Function cancel() in governance contract allow mark proposal as canceled only if it has status Executed.

It means that this function could be called even if proposal has status Queued (prepared for executing in timelock contract)

Impact

  1. It cause emiting event ProposalCanceled()

  2. This proposal wil be marked as canceled that it is not true

  3. Function state will start return incorrect status, which cause user confusion and they will go to create new proposal, but this proposal in timelock contract already. Proposal will be executed, but in governance contract will have status canceled.

Tools Used

Manual review

Recommendations

Do not allow cancel proposal if it has status queued or executed.

function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
ProposalState currentState = state(proposalId);
// @audit-think еще может быт статус когда Queued и в нем тоже нельзя отменять бы
- if (currentState == ProposalState.Executed) {
+ if (currentState == ProposalState.Executed || currentState == ProposalState.Queued) {
revert InvalidProposalState(proposalId, currentState, ProposalState.Active, "Cannot cancel executed proposal");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.