search

code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

_finalise inside finaliseProposal can never be triggered #280

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Impact

function finaliseProposal contains a line that can never be triggered: if(!hasQuorum(proposalID)){ _finalise(proposalID); } This is because it has a check above which makes sure that the proposal is already in the finalizing state: require(mapPID_finalising[proposalID] == true, "Must be finalising"); The only place where mapPID_finalising is set to true is function _finalise. What is even more strange is that the comment above the function says: "Proposal with quorum can finalise after cool off period", however, the actual check is !hasQuorum.

Recommended Mitigation Steps

Remove this unreachable branch or update guard conditions.

0xBrian commented 3 years ago

https://github.com/vetherasset/vaderprotocol-contracts/commit/f7c7085af0eb871ba80db3932acc703fd6d3623c

dmvt commented 3 years ago

duplicate of #186