Itβs possible to call delegate(tokenId1, tokenId2) using the same token tokenId1 multiple times. The previous delegated value isnβt deleted, and all delegations stack up.
This way tokenId2 will have all these tokens as delegated:
checkpoints[tokenId2][nCheckpoints-1].delegatedTokenIds = [tokenId1, tokenId1, ...]
When calculating the votes for this token, thereβs no check that the delegated tokens are different, so the values all sum together.
Alice has two tokens. She calls delegate(tokenId1, tokenId2) multiple times, accruing the voting power of tokenId2 over her true token balance.
During a governance proposal, GovernorAlpha#castVote will call VoteEscrow#getPriorVotes getting an artificially high voting power. She can use this power to pass whatever proposal she likes.
Consider adding a require(delegates[tokenId] == address(0)) in the function delegate. Changing a delegation this way requires the user to call removeDelegation beforehand.
The text was updated successfully, but these errors were encountered:
All reactions