Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Proposal Front-Running

ibukunola

Summary

The finding claims proposals in propose can be front-run via mempool monitoring, allowing malicious actors to submit competing proposals or block legitimate ones. The code’s propose lacks a commit-reveal scheme, making this valid, though the impact is moderated by voting delays and proposer checks. This medium-impact, high-likelihood issue holds true due to Ethereum’s public mempool.

Vulnerability Details

Claim: Mempool front-running blocks legitimate proposals.
Code:
propose creates a proposal with proposalId = _proposalCount++, no duplicate ID check.
No commit-reveal; proposal details (targets, calldatas) are public in tx.
Scenario:
User submits proposal in mempool.
Attacker front-runs with higher gas, same or competing proposal.
Legitimate proposal processes but may be outvoted or ignored if IDs clash.
Analysis:
No explicit ID conflict (each proposal gets a unique proposalId), but front-running can steal priority or confuse voters.
1-day votingDelay mitigates instant execution but not proposal submission.

Impact

Blocking or outvoting legitimate proposals is a medium-impact issue, disrupting governance without direct fund loss (e.g., $10M unaffected). The high likelihood reflects mempool visibility, a common Ethereum risk, making this a valid concern.

Tools Used

Manual Code Review: Confirmed no commit-reveal in propose.

Recommendations

Add commit-reveal scheme:

mapping(address => bytes32) private proposalCommits;
function commitProposal(bytes32 commitHash) external {
proposalCommits[msg.sender] = commitHash;
emit ProposalCommitted(msg.sender, commitHash);
}
function revealProposal(
address[] memory targets,
uint256[] memory values,
bytes[] memory calldatas,
string memory description,
ProposalType proposalType
) external {
bytes32 commitHash = keccak256(abi.encode(targets, values, calldatas, description, proposalType));
require(proposalCommits[msg.sender] == commitHash, "Invalid commit");
delete proposalCommits[msg.sender];
// ... existing propose logic ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.