A proposer can initiate several proposals at once through delegations

Lines of code Vulnerability details Impact Within the NounsDAOV3Proposals' propose function, a proposer is only permitted to have one active proposal at a time. Despite this, a proposer has the capability to delegate to various accounts, enabling these accounts to propose on their behalf. Proof o...

Anyone can cancel a future proposal

Lines of code Vulnerability details Impact Anyone can call NounsDAOLogicV3cancel with a future proposalIdproposalIdds.proposalCount, which would prevent the proposal with that proposalId from gaining votes, getting queued, or getting executed. So adversary can easily prevent any proposal which do...

ds._proposals mapping is never updated when a new proposal is created via propose() in NounsDAOV3Proposals.sol

Lines of code Vulnerability details Impact in function propose, after a new proposal is created, the ds.proposals variable in storage is never updated. Natspec comments for StorageV3 struct definition in NounsDAOInterfaces.sol says that ds.proposals is a mapping that contains references to all...

Vetoer can veto a non-existent proposal

Lines of code Vulnerability details Impact Vetoer is allowed to veto an invalid proposalId, which would prevent that proposal from getting votes, queued or executed. Proof of Concept Here is the veto function: function vetoNounsDAOStorageV3.StorageV3 storage ds, uint256 proposalId external if...