Closed code423n4 closed 1 year ago
Picodes marked the issue as primary issue
This is acknowledged system behavior and mentioned in documentation already
ith-harvey marked the issue as sponsor disputed
Disuputing as this is expected functionality... was mentioned in the white paper.
Invalid as this is mentioned in the whitepaper.
Picodes marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-grants/src/grants/base/ExtraordinaryFunding.sol#L105 https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-grants/src/grants/base/ExtraordinaryFunding.sol#L176 https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-grants/src/grants/base/ExtraordinaryFunding.sol#L213
Vulnerability details
Impact
With each executed offer, the value of
_getMinimumThresholdPercentage
increases, resulting in the fact that when trying to create a new proposal or execute existing,_getMinimumThresholdPercentage
exceeds1e18
and we catch an underflow error via_getSliceOfTreasury(Maths.WAD - minThresholdPercentage)
1,2. Which will lead to the impossibility of creating new extraordinary proposals or execute existing proposalWe have 2 points with this:
it also affects the methods associated with the corresponding calls, but these are minor problems, only the call files of the view methods
Proof of Concept
_getMinimumThresholdPercentage()
206: function _getMinimumThresholdPercentage() internal view returns (uint256) { 207: // default minimum threshold is 50 208: if (_fundedExtraordinaryProposals.length == 0) { 209: return 0.5 1e18; 210: } 211: // minimum threshold increases according to the number of funded EFM proposals 212: else { 213: return 0.5 1e18 + (_fundedExtraordinaryProposals.length (0.05 1e18)); 214: } 215: }
Maths.WAD - _getMinimumThresholdPercentage()
in our case, it's1e18 - 1.05e18
which will cause a subtraction errorTools Used
Recommended Mitigation Steps
Assessed type
Under/Overflow