DOS in governance when voting after delegate

Lines of code Vulnerability details Impact The GovernorCountingOverridable::handleVoteOverrides function substracts the delegator vote weight from the total votes when the delegatee has already submited a vote. However, if the delegator's vote is greater than the current total vote the substracti...

Front-running attack can occur between when the unbonding lock is created and when the delegator's bonded amount is decreased.

Lines of code Vulnerability details Impact This would allow the delegator to temporarily have more bonded tokens than they should. They could take advantage of this by voting in governance with the increased voting power or withdrawing increased fees Proof of Concept 1. When unbond is called, an...

Malicious users can manipulate the withdrawRound to withdraw their stake before the unbonding period is over.

Lines of code Vulnerability details Impact Disruption the normal bonding incentives and mechanisms in the protocol. Validators or transcoders could withdrew unexpectedly, preventing governance responses to bonded token changes. Proof of Concept The withdrawStake function first checks if the...

Inactive Orchestrators and delegators's vote still counts towards as effective when calculating the quota and quorum

Lines of code Vulnerability details Impact Inactive Orchestrators and delegators's vote still counts towards as effective when calculating the quota and quorum Proof of Concept According to the documentation, one of the priorty is to ensure the code implementation matches the LIP specification...

quorum and quota calculation logic is flawed

Lines of code Vulnerability details Impact quorum and quota calculation logic is flawed Proof of Concept votes to be valid, and if the poll passed or failed. At the time of writing, then QUORUM value is 33% of active stake, and the QUOTA is 50%, meaning that as long as 1/3rd of active stake votes...

using increaseTotalStakeUncheckpointed() instead of increaseTotalStake() can lead to inconsistent transcoder state

Lines of code Vulnerability details Impact This allows a transcoder to increase their voting power without actually increasing their stake. Proof of Concept The relevant code that uses increaseTotalStakeUncheckpointed and skips transcoder state checkpointing is in the updateTranscoderWithRewards...

Unprotected initialize functions can front-run by MEV or by an Attacker

Lines of code Vulnerability details Vulnerability Detail It should be avoided that the implementation of proxy contracts can be initialized by third parties. This can be the case if the initialize function is unprotected. Since the implementation contract is not meant to be used directly without ...

_weight - voter.deductions can revert in underflow when counting the vote

Lines of code Vulnerability details Impact weight - voter.deductions can revert in underflow when counting the vote Proof of Concept In the current implementation, when a voting, the function countVote is triggered, this function is overriden in the function GovernorCountingOverridable.sol weight...

The logic in _handleVoteOverride to determine if an account is transcoder is not consistent with the logic in the BondManager.sol

Lines of code Vulnerability details Impact The logic in handleVoteOverride to determine if an account is transcoder has issue Proof of Concept In the current implementation, when a voting, the function countVote is triggered, this function is overriden in the function...

December’s Reimagining Democracy Workshop

Imagine that weve all--all of us, all of society--landed on some alien planet, and we have to form a government: clean slate. We dont have any legacy systems from the US or any other country. We dont have any special or unique interests to perturb our thinking. How would we govern ourselves? Its...

Identity Threat Detection and Response: Rips in Your Identity Fabric

Why SaaS Security Is a Challenge In today's digital landscape, organizations are increasingly relying on Software-as-a-Service SaaS applications to drive their operations. However, this widespread adoption has also opened the doors to new security risks and vulnerabilities. The SaaS security atta...

Governor relay() functions can be used to bypass voting an directly run critical SecurityCouncilManager functions

Lines of code https://github.com/ArbitrumFoundation/governance/blob/c18de53820c505fc459f766c1b224810eaeaabc5/src/security-council-mgmt/governors/SecurityCouncilNomineeElectionGovernor.sol...

L1SCMgmtActivationAction does not check executor role of new and prev emergency security council

Lines of code Vulnerability details Proof of Concept GovernanceChainSCMgmtActivationAction.sol checks that the newEmergencySecurityCouncil has a upgradeExecutor role whereas the prevEmergencySecurityCouncil does not have a upgradeExecutor role. GovernanceChainSCMgmtActivationAction.sol // confirm...

Signatures can be replayed in castVoteWithReasonAndParamsBySig() to use up more votes than a user intended

Lines of code Vulnerability details Bug Description In the SecurityCouncilNomineeElectionGovernor and SecurityCouncilMemberElectionGovernor contracts, users can provide a signature to allow someone else to vote on their behalf using the castVoteWithReasonAndParamsBySig function, which is in...

GaugeController` allows for quick vote and withdraw

Lines of code Vulnerability details This issue was identified in the original Curve Finance audit, finding ID TOB-CURVE-DAO-004. It remains unresolved in the mkt.market implementation, but was fixed in the Curve implementation. Impact A malicious voter is able to use full voting power for multipl...

Delegated Votes Blocking Delegator Undelegation

Lines of code Vulnerability details Impact Once a delegator has delegated their votes to a delegatee, and the delegatee employs those votes in an ongoing proposal, the delegator loses the ability to undelegate their votes. VotingEscrow::delegate is used to delegate user A's votes to User B. Once...

Consider Disabling Inherited _cancel Function In The Governor Contracts

Lines of code Vulnerability details Impact The currently used openzeppelin upgradeable contracts dependency @openzeppelin/contracts-upgradeable is v4.7.3 The security council management contracts are inheriting the openzeppelin GovernorUpgradeable contracts to manage proposals. This version of...

No security council member can be proposed for removal using the propose function because it will always return MemberNotFound

Lines of code L134-L139 Vulnerability details Impact No security council member can be proposed for removal. Proof of Concept Going by the Arbitrum DAO constitution, a security council member cannot belong to first and second cohort at the same time. A security council member can either be in the...

Anyone can call perform in SecurityCouncilMemberSyncAction to update members of security council multisig

Lines of code Vulnerability details Impact Anyone can update members of security council multisig Proof of Concept SecurityCouncilMemberSyncAction contract has a perform function which is used to update members of security council multisig. File: SecurityCouncilMemberSyncAction.sol /// @notice...

A user can make sybil attack for manipulate gaugeController dao

Lines of code Vulnerability details Impact When voteforgaugeweights used contract just take info of users slope of exact time. And there is no extra check mechanism in protocol for control is user's delegate amount so slope too until user use voteforgaugeweights. So a user can use...