WordPress plugin wpdevart Poll，Survey，Questionnaire and Voting system 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

USER CAN BLOCK GOVERNANCE VOTING BY SUBMITTING MULTIPLE PROPOSALS

Lines of code Vulnerability details Impact A user can submit multiple proposals and then endorse each one of them to be able to activate them, and because the Governance contract allow only one active proposal, this user will be able to always activate his proposals and thus not allowing any othe...

Possibility of unfair voting

Lines of code Vulnerability details Impact The proposal could never get the THRESHOLD Proof of Concept On VoterRegistration.sol: 1- the voteradmin could mint issueVotesTo unlimited tokens to address0 or any address On Governance.sol: 2- this will effect to the totalSupply so no one can execute...

User Votes will stuck

Lines of code Vulnerability details Impact Due to insufficient checks User will not be able to withdraw there Votes after a non successful proposal. 1. The effect could be permanent if majority vote holders participated in the proposal, such that new proposal can't be created due to noone having...

Lock of voting power

Lines of code Vulnerability details Description There is a function vote in OlympusGovernance smart contract. It contains the logic for voting on proposals. In the case of failed vote voters' tokens will remain on the balance of OlympusGovernance until the activation of the new proposal. But for...

Race condition produces DDOS on governance : 20% minority can block the other 80% from passing a proposal.

Lines of code Vulnerability details Impact An account controlling enough voting percentage to endorse a proposal can block an unwanted proposal from being activated. This can be done by frontrunning or by paying more for gas. There can only be one concurrent activated proposal so there is a race...

Nouns NFT owner delegating voting power to the zero-address will lock all owned Nouns forever

Lines of code Vulnerability details Impact Nouns NFTs represent governance voting power by having the NounsToken contract inherit the ERC721Checkpointable contract. The ERC721Checkpointable contract is based on the Comp.sol implementation by Compound. One of the modifications is not needing to...

Voting power determined by proposal creation block enables inherent voting manipulation

Lines of code Vulnerability details Impact The voting power for a Nouns holder for a given proposal is calculated as the number of Nouns held at the time of proposal creation. This creates an opportunity for voting manipulation by the proposal creator because they can specifically choose the time...

MISSING INPUT CKECK WHEN SETTING NEW **QuorumCoefficient**

Lines of code Vulnerability details Impact In the setQuorumCoefficient , setDynamicQuorumParams functions when the admin sets a new QuorumCoefficient, there is no check on the newQuorumCoefficient parameter which means that a wrong QuorumCoefficient could be set either being very big or very smal...

User should not be able to use more votes that he has at the moment of voting

Lines of code Vulnerability details Impact In castVoteInternal function user can vote. And the votes that he has is calculated using the checkpoint when the proposal was created. This is not correct for few reasons. 1.Suppose in time t1 the proposal was created and in that time user1 had 2 tokens...

Votes which guarantee a majority for-vote can still result in a defeated proposal

Lines of code Vulnerability details Impact The current quorum logic in NounsDAOLogicV2.sol and NounsDAOLogicV1.sol seems undesirable. High, even complete, voter turnout may still not favour a majority for-vote, while a majority against-vote always wins, no matter how low the turnout is even zero...

ONLY ADMIN IS ABLE TO CHANGE THE VOTING PARAMETERS

Lines of code Vulnerability details Impact In both the NounsDAOLogicV1 and NounsDAOLogicV2 contracts, only admin is able to change the voting parameters which includes : VotingDelay VotingPeriod ProposalThresholdBPS MinQuorumVotesBPS MaxQuorumVotesBPS QuorumCoefficient This will ma...

WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability discovered by Kim Jong Min aka Universe Patchstack Alliance in WordPress Poll, Survey, Questionnaire and Voting system plugin versions = 1.7.4. Solution No patched version available...

GHSA-XRC4-737V-9Q75 OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

Impact This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals ma...

Wrong logic in increaseUnlockTime() function in case undelegated lock and call _checkpoint()

Lines of code Vulnerability details Impact In increaseUnlockTime function, in case it’s undelegated lock, it calls checkpoint for msg.sender with oldLocked and locked. But actually, these 2 locks oldLocked and locked are the same. It makes the logic in checkpoint function works incorrectly. Proof...

ERROR IN UPDATING **_checkpoint** IN THE **increaseUnlockTime** FUNCTION

Lines of code Vulnerability details Impact The potentiel impact of this error are : Give wrong voting power to a user at a given block. Give wrong total voting power at a given block. Give wrong total voting power. Proof of Concept The error occured in this line : In the increaseUnlockTime functi...

Checkpoint end time is not correct.

Lines of code Vulnerability details Checkpoint end time is not correct. Impact The user's voting power can be significantly decreased. Proof of Concept At L513 of VotingEscrow.sol, when we increase unlock time, oldLocked.end should be oldUnlockTime instead of unlocktime. We can double-check it fr...

Functions quitLock and delegate fundamentally change game theory of VoteEscrow

Lines of code Vulnerability details Impact Without delegation it is not possible to remove voting power before the end of a lock. Function quitLock now makes this possible, but it does not just affect the user who quits the lock. Any votes that are delegated to them are temporarily lost from the...

A delegatee can frontrun the delegator's call to increaseUnlockTime to prevent the delegator to withdraw or quitlock

Lines of code Vulnerability details Impact Charlie and Alice both create a lock, with Alice's lock being longer than Charlie's. Charlie then delegates to Alice. At this point, if Charlie wants to unlock his tokens he can call withdraw or quitLock, but not with a delegation in place see 1, 2, so h...

A malicious delegatee can always block the delegator from undelegating the lock

Lines of code Vulnerability details Impact A user who has delegated his/hers voting power to a delegatee can break his/hers delegate only by submitting a lock with a higher expiration time than the delegatee after a successful call to increaseUnlockTime function. After that, he has to call the...