c4-bot-5 commented 8 months ago

Lines of code

https://github.com/code-423n4/2024-01-salty/blob/main/src/dao/Proposals.sol#L155

Vulnerability details

Impact

It is possible to create a proposal with an invalid parameter type. The parameter type can range from 0 to 24 but when a parameter proposal ballot is created, the parameterType is never validated. Anyone can create an invalid proposal.

    function proposeParameterBallot(
        uint256 parameterType, // [0, 24]
        string calldata description
    ) external nonReentrant returns (uint256 ballotID) {       
        string memory ballotName = string.concat(
            "parameter:",
            Strings.toString(parameterType)
        );

        return
            _possiblyCreateProposal(
                ballotName,
                BallotType.PARAMETER,
                address(0),
                parameterType,
                "",
                description
            );
    }

If the voters decide to vote and finalize the invalid proposal during the calling of the finalizeBallot function, the whole transaction will revert. This is because in the _finalizeParameterBallot function, during the casting to ParameterType, it will return an error.

        if (winningVote == Vote.INCREASE)
            _executeParameterChange(
                ParameterTypes(ballot.number1), // revert
                true,
                poolsConfig,
                stakingConfig,
                rewardsConfig,
                stableConfig,
                daoConfig,
                priceAggregator
            );
        else if (winningVote == Vote.DECREASE)
            _executeParameterChange(
                ParameterTypes(ballot.number1), // revert
                false,
                poolsConfig,
                stakingConfig,
                rewardsConfig,
                stableConfig,
                daoConfig,
                priceAggregator
            );

Proof of Concept

Paste the test in the Proposals.t.sol file.

function testInvalidParameterBallot() public {
        vm.startPrank(DEPLOYER);
        staking.stakeSALT(1000 ether);
        proposals.proposeParameterBallot(999, "description" );
        vm.stopPrank();

    }