No validation allows unauthorized voting power transfer by any user.

Lines of code Vulnerability details Impact There is no check that the msg.sender is allowed to delegate votes on behalf of the sources. Any user could call delegateMulti and transfer voting power from other addresses. There should be a require statement to ensure msg.sender owns the tokens they a...

can not transfer voting tokens between ERC20ProxyDelegator contracts even if he supplied funds before

Lines of code Vulnerability details Description if a user wants to delegate voting power to a delegate he will call the function delegateMulti with targets array set to the address of the delegates he wants to delegate to, but the targets array is uint and not address type, so the user needs to...

User is unable to undelegate their votes from a ProxyDelegator

Lines of code Vulnerability details Impact The delegate is used to delegate sender's votes to someone else without the need to actually send the tokens. Here is a quick intro for the function: delegateaddress delegatee This function allows msg.sender to delegate their voting power to delegatee an...

_reimburse and createProxyDelegatorAndTransfer uses ERC20Votes.transferFrom with user as msg.sender, but allowance is given for ERC20MultiDelegate contract.

Lines of code Vulnerability details Description The delegateMulti external method is called by user. This function call some internal functions like reimburse and transferBetweenDelegators, which doesn't change the msg.sender because they are internal. So, when these functions try to use...