Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Cancel function allows cancelling succeeded and queued proposals

aravn

Vulnerability Details

Contract : Governance

The cancel function is used to cancel an existing proposal.
A proposal can currently be cancelled the proposal during any phase unless it is already executed.

if the proposer’s voting power has dropped below the threshold or if the proposer themselves cancel it.
A proposer can currently cancel the proposal during any phase unless it is already executed.

enum ProposalState {
Pending, // Created but not yet active
Active, // In voting period
Canceled, // Canceled by proposer
Defeated, // Failed to meet quorum or majority
Succeeded, // Passed vote but not queued
Queued, // Scheduled in timelock
Executed // Successfully executed
}

This is an issue because in many standard governance systems
once a proposal has passed (i.e. reached a "Succeeded" state)
and especially after it’s queued for execution,
it’s treated as final and CANNOT be canceled.

Allowing a proposal to be canceled after it has succeeded undermines the finality of a democratic vote
if a proposer’s stake can change after the fact.

Uncertainty : voters may be unsure whether a passed proposal will eventually be executed.

Impact

Succeeded and queued proposals can still be cancelled
creating uncertainity and undermining standard practice.

Impact : Medium
Likelihood : Medium

Recommendations

Disallow canceling already Succeeded and Queued proposals

function cancel(uint256 proposalId) external override {
ProposalCore storage proposal = _proposals[proposalId];
if (proposal.startTime == 0) revert ProposalDoesNotExist(proposalId);
​
ProposalState currentState = state(proposalId);
​
// Prevent cancellation if the proposal is succeeded or queued
if (currentState == ProposalState.Succeeded || currentState == ProposalState.Queued) {
revert InvalidProposalState('Cannot cancel a succeeded or queued proposal');
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance::cancel allows canceling proposals in Succeeded and Queued states, enabling single actors to override community decisions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.