Unexpected result can occur because the result of the winningParameterVote function would be NO_CHANGE when the increaseTotal and decreaseTotal are the same.
Proof of Concept
In _finalizeParameterBallot function of DAO contract, the winningParameterVote function of Proposals contract is called.
function _finalizeParameterBallot( uint256 ballotID ) internal
{
Ballot memory ballot = proposals.ballotForID(ballotID);
Vote winningVote = proposals.winningParameterVote(ballotID);
if ( winningVote == Vote.INCREASE )
_executeParameterChange( ParameterTypes(ballot.number1), true, poolsConfig, stakingConfig, rewardsConfig, stableConfig, daoConfig, priceAggregator );
else if ( winningVote == Vote.DECREASE )
_executeParameterChange( ParameterTypes(ballot.number1), false, poolsConfig, stakingConfig, rewardsConfig, stableConfig, daoConfig, priceAggregator );
// Finalize the ballot even if NO_CHANGE won
proposals.markBallotAsFinalized(ballotID);
emit BallotFinalized(ballotID, winningVote);
}
However, in winningParameterVote function, when the increaseTotal and decreaseTotal are the same, it returns the NO_CHANCE even if the noChangeTotal is 0.
This can produce unexpected results for ballots with intense voting competition, and in the worst case, it can be exploited by malicious users.
Tools Used
VS Code
Recommended Mitigation Steps
Should decide how return the result when the increaseTotal and decreaseTotal are the same and update the winningParameterVote function with that logic.
Lines of code
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/dao/Proposals.sol#L364-L381
Vulnerability details
Impact
Unexpected result can occur because the result of the
winningParameterVote
function would beNO_CHANGE
when theincreaseTotal
anddecreaseTotal
are the same.Proof of Concept
In
_finalizeParameterBallot
function ofDAO
contract, thewinningParameterVote
function ofProposals
contract is called.However, in
winningParameterVote
function, when theincreaseTotal
anddecreaseTotal
are the same, it returns theNO_CHANCE
even if thenoChangeTotal
is 0. This can produce unexpected results for ballots with intense voting competition, and in the worst case, it can be exploited by malicious users.Tools Used
VS Code
Recommended Mitigation Steps
Should decide how return the result when the
increaseTotal
anddecreaseTotal
are the same and update thewinningParameterVote
function with that logic.Assessed type
Other