Lines of code
<https://github.com/code-423n4/2023-12-autonolas/blob/main/governance/contracts/GovernorOLAS.sol#L14-L15&gt;

Vulnerability details

Impact

In the “GovernorOLAS.sol” contract, as the comment line supports the OpenZeppelin functions are used as is. However, the inherited OpenZeppelin 4.8.3 library exposes a signature replay vulnerability due to the lack of use of nonce in the castVoteWithReasonAndParamsBySig() functions in “Governor.sol”.

Proof of Concept

• Bob has 1000 votes, and he wants to split his votes between proposals A and B.
• He signs one signature to give 500 votes to proposal A.
• He signs a second signature to allocate 500 votes to proposal B.
• castVoteWithReasonAndParamsBySig() is called to submit Bob’s first signature:
• This gives proposal A 500 votes.
• After the transaction is executed, Alice sees Bob’s signature in the transaction.
• As Alice wants proposal A to be elected, she calls castVoteWithReasonAndParamsBySig() with Bob’s first signature again:
• Due to a lack of a nonce, the transaction is executed successfully, giving proposal A another 500 votes.
• Now, when castVoteWithReasonAndParamsBySig() is called with Bob’s second signature, it reverts as all his 1000 votes are already allocated to proposal A.
  In the scenario above, Alice has managed to allocate all of Bob’s votes to proposal A against his will.

Due to the lack of a nonce, castVoteWithReasonAndParamsBySig() can be called multiple times with the same signature.

Therefore, if a user provides a signature to use a portion of his votes, an attacker can repeatedly call castVoteWithReasonAndParamsBySig() with the same signature to use up more votes than the user originally intended.

You can also check out this report for the same finding: code-423n4/2023-08-arbitrum-findings#252

Tools Used

Manual Review

Recommended Mitigation Steps

Consider adding signature replay protection to the castVoteWithReasonAndParamsBySig() function using nonce. You can also use the latest version of Openzeppelin, which has the nonce feature already added.

Assessed type

Library

The text was updated successfully, but these errors were encountered:

All reactions