Lines of code

Vulnerability details

Impact

Each voter can veto a proposal if they want by calling voteToVeto() several times to pass the passThresholdBps.

Proof of Concept

Every voter shouldn’t vote several times, otherwise, the voting system will be broken.

But voteToVeto() doesn’t check the already voted users and it can be called as many times.

The below POC shows the case.

    function test_CanVoteManyTimes() public {
        _assertProposalStatus(PartyGovernance.ProposalStatus.Voting);

        // Vote to veto
        vm.prank(voter1);
        vetoProposal.voteToVeto(party, proposalId, 0);

        _assertProposalStatus(PartyGovernance.ProposalStatus.Voting);
        assertEq(vetoProposal.vetoVotes(party, proposalId), 1e18);

        // The same voter can vote again and again
        vm.prank(voter1);
        vetoProposal.voteToVeto(party, proposalId, 0);

        _assertProposalStatus(PartyGovernance.ProposalStatus.Defeated);
    }

Tools Used

Manual Review

Recommended Mitigation Steps

We should add a mapping like hasVoted in PartyGovernance contract to ensure each voter can’t vote several times.

The text was updated successfully, but these errors were encountered:

All reactions