Core Contracts

Summary

On Governance::propose#L144 function we can see it is using _proposalCount and incrementing it for proposalId

Vulnerability Details

Governance::propose#L144

Impact

Let's say the users are creating new proposals

Now in between a block re-org happens.

So after the re-org the proposalId will get a wrong value.

Like user A's proposal can get the Id of user B, and B might get A's proposalId.

As we can see after creating the proposal all the actions will be performed based on proposalId.

So let's say one user wants to cancel his proposal and he passes the proposalId, but ultimately we can see the proposal he is assuming as his, is not true. Ultimately he got the ownership of another proposalId

Tools Used

Manual

Recommendations

There are a lot of ways to mitigate it.

One is like creating proposalId as a string and tracking it through mapping.