wrong return value of totalVotingPower leads to break the OffChainSignatureValidator#isValidSignature() functionality

Lines of code Vulnerability details Bug Description in the OffChainSignatureValidatorisValidSignature function we returns the singerVotingPowerBPS in term of BPSpoints by mul it by 1000 and the totalVotingPower is returned by calling the party.getGovernanceValues.totalVotingPower which is normal...

Signature malleability can occur by using EVM's ecrecover

Lines of code Vulnerability details Impact EVM's ecrecover is susceptible to signature malleability which allows replay attacks, check this. Proof of Concept OffChainSignatureValidator in its function isValidSignature checks for signature validity by using vulnerable method of ecrecover. address...