Submission Details
Impact:
Likelihood:
Documentation Mismatch: Transaction Proposal Permissions
Author Revealed upon completion
Root + Impact
Description
-
Normal behavior:
According to documentation, any signer should be able to propose transactions.
Issue:
The contract restricts transaction proposals to the owner only, contradicting the documented governance model.
function proposeTransaction(...)
external
onlyOwner
returns (uint256)
Risk
Likelihood:
-
Occurs immediately when signers attempt to propose transactions
Occurs during audits, integrations, or DAO handover
Impact:
-
Governance confusion
Incorrect trust assumptions by users or auditors
Proof of Concept
// Signer (non-owner)
proposeTransaction(...); // reverts due to onlyOwner
Recommended Mitigation
- Any signer can propose transactions
+ Only the owner can propose transactions at documentaion level
or
- onlyOwner
+ onlyRole(SIGNING_ROLE) at code level
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.