search

code-423n4 / 2022-09-party-findings

2 stars 0 forks source link

No control for the future `Airdrop` #291

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/party/PartyGovernance.sol#L690

Vulnerability details

Impact

You can't control the airdrop NFT on this contract PartyGovernance.sol. You can only control the preciousListHash

Proof of Concept

The execute() is check that the precious list preciousTokenIds and preciousTokens is valid or not 

if (!_isPreciousListCorrect(preciousTokens, preciousTokenIds)) {
            revert BadPreciousListError();
        }

You can set them only on the first when you create a proposal

Recommended Mitigation Steps

Add more flexibility to control the future airdrop

merklejerk commented 1 year ago

This seems like a feature request. There is no security issue here.

HardlyDifficult commented 1 year ago

Agree - out of scope for this contest. Closing as invalid.