Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Quorum calculation uses current total voting power instead of historical value

dobrevaleri

Summary

The getDebugInfo function uses the current quorum requirement instead of the historical value at proposal creation time, leading to incorrect reporting of required votes for past proposals.

Vulnerability Details

In Governance::getDebugInfo, the quorum requirement is fetched using the quorum() function which calculates based on the current total voting power and quorum numerator:

function quorum() public view override returns (uint256) {
return (_veToken.getTotalVotingPower() * quorumNumerator) / QUORUM_DENOMINATOR;
}

This is problematic because:

  1. The total voting power can change over time as veRAAC tokens are locked/unlocked

  2. The quorum numerator can be modified by the owner via setParameter()

  3. Historical proposals should reference the quorum requirement at their creation time

Impact

The getDebugInfo function will return incorrect quorum requirements for historical proposals if:

  • The total voting power has changed since proposal creation

  • The quorum numerator was modified by governance

While this does not affect on-chain functionality or proposal execution, it provides misleading data for:

  • Off-chain analytics and reporting

  • User interfaces showing proposal status

  • Historical proposal auditing

Recommendations

Store quorum requirement at proposal creation

struct ProposalCore {
uint256 id;
address proposer;
ProposalType proposalType;
uint256 startTime;
uint256 endTime;
bool executed;
bool canceled;
+ uint256 requiredQuorum;
bytes32 descriptionHash;
address[] targets;
uint256[] values;
bytes[] calldatas;
}
​
function propose(...) external override returns (uint256) {
// ... existing code ...
proposal.requiredQuorum = quorum();
// ... rest of function
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::quorum uses current total voting power instead of proposal creation snapshot, allowing manipulation of threshold requirements to force proposals to pass or fail

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::quorum uses current total voting power instead of proposal creation snapshot, allowing manipulation of threshold requirements to force proposals to pass or fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!