Signatures can be replayed in castVoteWithReasonAndParamsBySig() to use up more votes than a user intended

Lines of code Vulnerability details Bug Description In the SecurityCouncilNomineeElectionGovernor and SecurityCouncilMemberElectionGovernor contracts, users can provide a signature to allow someone else to vote on their behalf using the castVoteWithReasonAndParamsBySig function, which is in...

Governor relay() functions can be used to bypass voting an directly run critical SecurityCouncilManager functions

Lines of code https://github.com/ArbitrumFoundation/governance/blob/c18de53820c505fc459f766c1b224810eaeaabc5/src/security-council-mgmt/governors/SecurityCouncilNomineeElectionGovernor.sol...

No security council member can be proposed for removal using the propose function because it will always return MemberNotFound

Lines of code L134-L139 Vulnerability details Impact No security council member can be proposed for removal. Proof of Concept Going by the Arbitrum DAO constitution, a security council member cannot belong to first and second cohort at the same time. A security council member can either be in the...

Delegation empowers more voting weight than expected

Lines of code Vulnerability details Description and Impact The user's voting power decreases linearly from the moment of the lock. To prevent this decrease, users can delegate their voting power to a new wallet. Here is an example scenario illustrating this: 1. The user owns two wallets, Wallet A...

[M-01] SecurityCouncilNomineeElectionGovernor.includeNominee(): Missing check adhering to constitution when nominee vetter include nominee

Lines of code Vulnerability details Impact SecurityCouncilNomineeElectionGovernor.solL290-L317 function includeNomineeuint256 proposalId, address account external onlyNomineeVetter ProposalState state = stateproposalId; if state != ProposalState.Succeeded revert ProposalNotSucceededStatestate; if...

Consider Disabling Inherited _cancel Function In The Governor Contracts

Lines of code Vulnerability details Impact The currently used openzeppelin upgradeable contracts dependency @openzeppelin/contracts-upgradeable is v4.7.3 The security council management contracts are inheriting the openzeppelin GovernorUpgradeable contracts to manage proposals. This version of...

Anyone can change the members of Security Council

Lines of code Vulnerability details Impact Anyone can change the members of security council by calling the function perform in the contract SecurityCouncilMemberSyncAction.sol as the function is open to all. Proof of Concept uint256 updateNonce = getUpdateNoncesecurityCouncil; if nonce =...

SecurityCouncilMemberElectionGovernor Owner Can Change votingPeriod During an Active Election

Lines of code Vulnerability details Impact In SecurityCouncilMemberElectionGovernor contract : relay function enables the contract owner from making calls to any contract address. And in SecurityCouncilMemberElectionGovernorCountingUpgradeable contract: setFullWeightDuration can be accessed only ...

A user can make sybil attack for manipulate gaugeController dao

Lines of code Vulnerability details Impact When voteforgaugeweights used contract just take info of users slope of exact time. And there is no extra check mechanism in protocol for control is user's delegate amount so slope too until user use voteforgaugeweights. So a user can use...

Contrary to sponsor's intent, the gauge's weight will not be updated properly if governance do not change weight before any voting

Lines of code Vulnerability details Impact This is the intended procedure based on Sponsor's answer in discord: Q: when we add new gauge we don't set any weight point or any data for it, did the new gauge will get the weight and power by time when users vote for it ?! A: Yes, the idea is that the...

Delegated Votes Blocking Delegator Undelegation

Lines of code Vulnerability details Impact Once a delegator has delegated their votes to a delegatee, and the delegatee employs those votes in an ongoing proposal, the delegator loses the ability to undelegate their votes. VotingEscrow::delegate is used to delegate user A's votes to User B. Once...

setFullWeightDuration() can be called while a member election is ongoing

Lines of code Vulnerability details Bug Description In SecurityCouncilMemberElectionGovernorCountingUpgradeable, fullWeightDuration which is the duration where a user's votes has weight 1 can be set using setFullWeightDuration: SecurityCouncilMemberElectionGovernorCountingUpgradeable.solL77-L84...

GaugeController` allows for quick vote and withdraw

Lines of code Vulnerability details This issue was identified in the original Curve Finance audit, finding ID TOB-CURVE-DAO-004. It remains unresolved in the mkt.market implementation, but was fixed in the Curve implementation. Impact A malicious voter is able to use full voting power for multipl...

Anyone can call perform in SecurityCouncilMemberSyncAction to update members of security council multisig

Lines of code Vulnerability details Impact Anyone can update members of security council multisig Proof of Concept SecurityCouncilMemberSyncAction contract has a perform function which is used to update members of security council multisig. File: SecurityCouncilMemberSyncAction.sol /// @notice...

receive function allows any user to lose funds

Lines of code Vulnerability details Impact Lending ledger receive function allows for any user to send funds and lose them forever. Proof of Concept Any user that sends funds to the Lending Ledger contract through the receive function, can't withdraw their funds meaning they would be stuck in...

Microsoft Purview data security mitigations for BazaCall and other human-operated data exfiltration attacks

I recently worked with an enterprise customer who experienced a data exfiltration attack using the characteristics of the BazaCall campaign. BazaCall can be both a ransomware and data exfiltration attack that are used together to increase pressure on and damage to the victim. Microsoft Purview ha...

New SEC Rules around Cybersecurity Incident Disclosures

The US Securities and Exchange Commission adopted final rules around the disclosure of cybersecurity incidents. There are two basic rules: 1. Public companies must "disclose any cybersecurity incident they determine to be material" within four days, with potential delays if there is a national...

The vulnerability of the Identity Manager software component, used for managing and controlling access to corporate resources and IBM Security Verify Governance applications, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Identity Manager software component, which is used for managing and controlling access to corporate resources and applications in IBM Security Verify Governance, stems from insufficient validation of arguments passed to the command process. Exploiting this vulnerability...

CVE-2023-35019

IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 257873...

CVE-2023-35016

IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 257772...