addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Impact Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having ...

CVE-2023-4642 kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition

The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition...

User loss his delegated voting power after delegation to another user.

Lines of code Vulnerability details Vulnerability Details When a user delegate voting power to another user, his previous voting power from delegation has been ignored at getVotingPowerAt since in case isDelegated is true getVotingPowerAt returns 0. Impact Delegated voting power cannot be utilize...

Hosts should agree before performing operations like setting ragequit, vetoing

Lines of code Vulnerability details Impact Since a Party can have multiple hosts, they should agree before vetoing or setting rageQuit, to prevent a single compromised host from having absolute decision, just as is done when hosts accept a proposal Proof of Concept In PartyGovernanceveto and...

A malicious contributor can increase voting power maliciously and eventually steal funds!

Lines of code Vulnerability details Impact Unlimited voting power for attacker and stealing of funds ! Proof of Concept All of the contribute functions uses msg.value to calculate the votingpower . For example , contribute function looks like this : function contribute uint256 tokenId, address...

Arthimetic operation result in loss of voting power

Lines of code Vulnerability details Impact Carrying out calculation of voting power in function finalize based on division with value 1e4, then subtracting it with totalContributions and after that multiplying and dividing again will be a resultant that cause large precision error or even loss of...

Increasing of totalVotingPower during crowdfund can lead to users losing funds.

Lines of code Vulnerability details Bug Description The recent code update allows authorities to be declared at the start of the crowdfunding phase. This change allows authority-restricted functions to be called during the crowdfunding phase by the authorities added in the party constructor...

DoS in Providing Voting power after contribution due to minting based on totalVotingPower in PartyGovernanceNFT.increaseVotingPower

Lines of code Vulnerability details Impact The PartyGovernanceNFT contract was designed in such a way that it wont mint, increaseVotingPower if totalMint mintedVotingPower wont cross the totalVotingPower, if crossing only the difference between them totalVotingPower - mintedVotingPower will be...

Users of ReraiseCrowdfund will potentially not receive appropriate voting power

Lines of code Vulnerability details Bug Description The recent code update introduces the functionality for authorities to reduce the total voting power by invoking the decreaseTotalVotingPower function of the party. However, this functionality can lead to issues when used in the time frame after...

Users can lose eth when contributing.

Lines of code Vulnerability details Impact When contributing in InitialETHCrowdfund, if minting adjusts the voting power for that user to cap it at totalVotingPower, the user does not get refunded the eth he lost. Proof of Concept PartyGovernanceNFTmint caps the mintedVotingPower at...

increaseTotalVotingPower() can be front-ran by an attacker with a call to rageQuit() in order to withdraw more assets than the attacker should be able to claim.

Lines of code Vulnerability details Overview of the vulnerability / PoC The function increaseTotalVotingPower in PartyGovernanceNFT does not have a front-running protection against rageQuit allowing a user to walk away with more assets than he should. An example of the attack 1. A party member...

Potential negative value of votingPowerByTokenId

Lines of code Vulnerability details Impact Based on the context and functionality being used in the PartyGovernanceNFT contract, an authority address can reduce voting power by specifying the degree of reduction but the negative difference wasn't considered. Proof of Concept IN this function...

In parties with more than one host, a single host can bypass the execution delay of a proposal by transferring his host status to other addresses of his.

Lines of code Vulnerability details The Vulnerability After a proposal has gathered enough votes to pass, it waits through a period defined in the governance values named executionDelay. That executionDelay period is bypassed and the proposal can be executed immediately if ALL hosts of the party...

Upgraded Q -> 2 from #175 [1699029356616]

Judge has assessed an item in Issue 175 as 2 risk. The relevant finding follows: L-02 Initial values for GovernorSettings are very low ODGovernor is a OZ Governor with some plugins. It sets up its parameters in the constructor: ODGovernor::constructor: File: src/contracts/gov/ODGovernor.sol 41:...

Upgraded Q -> 2 from #320 [1699029580772]

Judge has assessed an item in Issue 320 as 2 risk. The relevant finding follows: 2. The governor setting not reliable The initial setting for the voting period in ODGovernor is 15 block, which can be too tight for the governance. Based on Arbitrum block time, which is about 0.26 seconds, which ca...

The GovernorSettings are set to incorrect values

Lines of code Vulnerability details When ODGovernor is deployed the GovernorSettings is initialized with the initialVotingDelay, initialVotingPeriod and initialProposalThreshold. The problem is that the initialVotingDelay and initialVotingPeriod are set to incorrect values which are really small...

Security Vulnerability of Switzerland’s E-Voting System

Online voting is insecure, period. This doesnt stop organizations and governments from using it. And for low-stakes elections, its probably fine. Switzerland--not low stakes--uses online voting for national elections. Andrew Appel explains why its a bad idea: Last year, I published a 5-part serie...

Some ERC20Votes tokens will not work if you set approve() to any value without setting to zero first

Lines of code Vulnerability details Impact Not setting allowance to Zero before changing the allowance can hinder the deployment of the ERC20ProxyDelegator contract for some ERC20 tokens Proof of Concept Some ERC20 tokens like USDT with Voting enabled will not work when changing the allowance fro...