Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Proposers With Sufficent Voting Power are Unable to Cancel Their Votes

opecon

Summary

Proposers with sufficient voting power will not be able to cancel their proposals as needed due to wrong check in Governance::cancel()

Vulnerability Details

In the Governance.sol contract the cancel() function is implemented to allow proposers to cancel their proposal if they have enough voting power

function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
ProposalState currentState = state(proposalId);
if (currentState == ProposalState.Executed) {
revert InvalidProposalState(proposalId, currentState, ProposalState.Active, "Cannot cancel executed proposal");
}
​
// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer &&
_veToken.getVotingPower(proposal.proposer) >= proposalThreshold) { // @audit wrong comparison use < instead
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
​
proposal.canceled = true;
emit ProposalCanceled(proposalId, msg.sender, "Proposal canceled by proposer");
}

The vulnerability lies in the check that is used to determine if the proposer's voting power dropped below threshold, as it checks in the opposite direction and reverts if the voting power is greater than the threshold which is wrong and wouls disallow proposer's with sufficient voting power from cancelling a proposer. On the flipside it also allows proposers with insufficient voting power to cancel their proposer

Impact

Proposers with valid amounts of voting power will not be able to cancel their proposers as it the cancel() function will always revert if they have enough voting power.

Tools Used

Manual Review

Recommendations

The correct check should be if the voting power is less thatn the proposalThreshold

// Only proposer or if proposer's voting power dropped below threshold
if (msg.sender != proposal.proposer &&
_veToken.getVotingPower(proposal.proposer) < proposalThreshold) { // @audit wrong comparison use < instead
revert InsufficientProposerVotes(proposal.proposer,
_veToken.getVotingPower(proposal.proposer), proposalThreshold, "Proposer lost required voting power");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!