search

code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

Undefined behavior for DAO and GRANT vote proposals in DAO.sol #183

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

0xRajeev

Vulnerability details

Impact

Given that there are only three proposal types (GRANT, UTILS, REWARD) that are actionable, it is unclear if 'DAO' type checked in voteProposal() is a typographical error and should really be 'GRANT'. Otherwise, GRANT proposals will only require quorum (33%) and not majority (50%).

Proof of Concept

https://github.com/code-423n4/2021-04-vader/blob/3041f20c920821b89d01f652867d5207d18c8703/vader-protocol/contracts/DAO.sol#L79-L92

Tools Used

Manual Analysis

Recommended Mitigation Steps

Change ‘DAO’ on L83 to ‘GRANT’ or if not, specify what DAO proposals are and how GRANT proposals should be handled with quorum or majority.

Also, check and enforce that mapPID_types are only these three actionable proposal types: GRANT, UTILS, REWARD.

strictly-scarce commented 3 years ago

DAO not yet fully implemented