Ex-token holders are still able to cast votes on proposals under certain circumstances

Lines of code Vulnerability details When casting a vote, an address is limited to a certain amount of votes derived from ds.nouns.getPriorVotes. However, due to the nature of ds.nouns.getPriorVotes, the amount of votes available to an address solely depends on the amount of tokens they held when ...

Proposal can executed even when it is in the "Queued" state.

Lines of code Vulnerability details Impact An attacker can bypass the intended governance process and directly execute proposals that are still in the voting or canceled state. This can result in unauthorized actions being performed on the smart contract, leading to loss of funds Proof of Concept...

Proposal remains open to votes for only 3 blocks instead of 7 days

Lines of code Vulnerability details Impact LybraGovernance contract only allows to vote during the first 3 blocks after the snapshot is taken. Assuming it takes roughly 12 seconds per 1 block on Ethereum, it is only 36 seconds to decide and vote for a proposal. This would be too fast for a regula...

Voting period hardcoded to 3 blocks

Lines of code Vulnerability details Impact Here in the Governance contract, the voting period is locked to 3 blocks. function votingPeriod public pure override returns uint256 return 3; function votingDelay public pure override returns uint256 return 1; This is a direct bug because if we take a...

Wrong proposalThreshold amount in LybraGovernance.sol

Lines of code Vulnerability details Impact The proposal can be created with only 100000 esLBR delegated instead of 10000000. Proof of Concept According to LybraV2Docs, a proposal can only be created if the sender has at least 10 million esLBR tokens delegated to his address to meet the proposal...

GHSA-5H3X-9WVQ-W4M2 OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning

Impact By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the Governor contract in v4.9.0 only, and the...

OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning

Impact By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the Governor contract in v4.9.0 only, and the...

Design/Logic Flaw

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

CVE-2023-34234 Governor proposal creation may be blocked by frontrunning in OpenZeppelin

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

CVE-2023-34234 Governor proposal creation may be blocked by frontrunning in OpenZeppelin

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

OpenZeppelin security vulnerabilities

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts versions prior to 4.3.0 through 4.9.1 that stems from allowing an attacker to gain the ability to cancel a proposal by creating it in advance...

CVE-2023-34234: Missing Authorization

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

PT-2023-24758

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions 4.3.0 through 4.9.0 Description The issue allows an attacker to become the proposer and gain the ability to cancel a proposal by frontrunning its creation. This can be done repeatedly to prevent a proposal from...

Possible overflow in PartyGovernance._isUnanimousVotes()

Lines of code Vulnerability details Impact Proposals can't be executed if totalVotes = 8e24. Furthermore, if emergencyExecuteDisabled == true and rageQuitTimestamp == DISABLERAGEQUITPERMANENTLY, users can't take out the funds from the party forever. Proof of Concept In isUnanimousVotes, it...

accept() can be delayed or gas-griefed by burning a governance NFT

Lines of code Vulnerability details Impact Rage quitting or burning a token will set the lastBurnTimestamp to the current block's timestamp. This disables accept for the rest of the transactions in the block. This bug can be abused to either gas-grief or delay acceptance of proposals long enough...

Extraordinary proposal can become stuck

Lines of code Vulnerability details Since standard and extraordinary proposals use the same treasury funds accounting variables and extraordinary voting period is long enough 1 month, it is possible that extraordinary proposal that was valid and gained enough votes will end up frozen: it might no...

Missing Proposal Validations in Funding Contract.

Lines of code Vulnerability details Impact The Funding.sol contract's validateCallDatas function validates the targets, values, and calldatas parameters for a proposal but does not check if the proposal is valid based on the current state of the contract. For example, it does not check if the...

Attacker can DoS create a extraordinary proposals

Lines of code Vulnerability details Impact An attacker can prevent the creation of proposals in ExtraordinaryFunding.solproposeExtraordinary by front-running the proposal, which will give him the same hash as the correct user desired, and setting endBlock to the past, which will invalidate the...

Insufficient Validation of Total Tokens Requested.

Lines of code Vulnerability details Impact In the proposeExtraordinary function in the Funding contract. Specifically, in the following line: L105 if uint256totalTokensRequested getSliceOfTreasuryMaths.WAD - getMinimumThresholdPercentage revert InvalidProposal; If the totalTokensRequested paramet...

It is possible to steal the unallocated part of every delegation period budget

Lines of code Vulnerability details Attacker can monitor the standard proposals distribution and routinely steal each low activity period remainder by submitting a transfer to self proposal and voting a dust amount for it. Since the criteria for the final slate update is that any increase in tota...