The result of getPastVotes can be different time after time

Lines of code Vulnerability details Impact In moveDelegateVotes of ERC721Votes.sol, we write checkpoint every time, so there might be several checkpoints in the same timestamp. In that case, when we get past votes in getPastVotes, we use binary search by timestamp. But there might be several...

Allowing multiple checkpoints in a single block can be abused to increase voting power on select proposals

Lines of code Vulnerability details Impact Votes can be multiplied allowing for governance attacks Proof of Concept // Get the pointer to store the checkpoint Checkpoint storage checkpoint = checkpointsaccountid; // Record the updated voting weight and current time checkpoint.votes =...

Its possible to underflow votes using delegate and delegateBySig on ERC721Votes.sol

Lines of code Vulnerability details Impact Is possible to generate an underflow on ERC721Votes.solL216 mainly because its wrapped in an unchecked bracked. prevTotalVotes could be lower than amount so this will generate and underflow; writeCheckpointfrom, nCheckpoints, prevTotalVotes, prevTotalVot...

ERC721Votes: Token owners can double voting power through self delegation

Lines of code Vulnerability details The owner of one or many ERC721Votes tokens can double their voting power once and only once by delegating to their own address as their first delegation. Scenario This exploit relies on the initial default value of the delegation mapping in ERC721Votes, which ...

Adversary can gain Infinite voting power due to integer overflow

Lines of code Vulnerability details Impact Specifically, ERC721Votes enables users to delegate their voting power to others. Note that when delegating the voting power, the actual token balance will not change. On the other hand, when transferring tokens, the voting power transfers accordingly:...

Use can get unlimited votes

Lines of code Vulnerability details Impact aftertokenTransfer in ERC721Votes transfers votes between user addresses instead of the delegated addresses, so a user can cause overflow in moveDelegates and get unlimited votes Proof of Concept function afterTokenTransfer address from, address to,...