Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Voting Power Issue

dharkartz

Summary

The proposal governance contract lacks proper validation of proposer voting power throughout a proposal's lifecycle. While the contract allows proposal cancellation when voting power drops below threshold, it fails to actively monitor or enforce minimum voting power requirements after proposal creation.

Issue Description

Finding: Proposer's Voting Power Can Drop Below Threshold After Proposal Creation:

function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
ProposalState currentState = state(proposalId);
if (currentState == ProposalState.Executed) {
revert InvalidProposalState(proposalId, currentState, ProposalState.Active, "Cannot cancel executed proposal");
}
​
// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer &&
_veToken.getVotingPower(proposal.proposer) >= proposalThreshold) {
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
​
proposal.canceled = true;
emit ProposalCanceled(proposalId, msg.sender, "Proposal canceled by proposer");
}

Root Cause Analysis

  • Initial voting power check occurs only at proposal creation

  • No mechanism tracks proposer's voting power changes

  • Contract allows proposals to remain active despite proposer becoming ineligible

  • Voting power verification only happens during cancellation attempts

Potential Exploit Scenario

  1. Proposer creates proposal with sufficient voting power

  2. Proposer reduces voting power below threshold

  3. Proposal remains active despite proposer's ineligibility

Recommendations

  • Implement storage of proposer's initial voting power during proposal creation

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.