The USD price update proposal contract allows roles to vote both for and against a proposal, which can lead to manipulation of the approval and disapproval counts. This vulnerability undermines the integrity of the voting process.
The USD price update proposal contract allows each role to cast both an approval and a disapproval vote for the same proposal. This can result in inconsistent and inaccurate counts for approvals and disapprovals, leading to the following issues:
Proposals may be incorrectly approved or disapproved based on manipulated vote counts.
Roles can effectively neutralize their own votes, causing confusion and deletions of correct proposals.
Even if roles are to be trusted,this should still be prevented in case of unforeseen circumstances like the roles losing access to bad actors.
Impact
Roles can manipulate the approval and disapproval counts.
Proposals might get approved or disapproved based on inaccurate counts.
Also can lead to deletion of correct proposals.
Lines of code
https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L177-L207 https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L210-L242
Vulnerability details
The USD price update proposal contract allows roles to vote both for and against a proposal, which can lead to manipulation of the approval and disapproval counts. This vulnerability undermines the integrity of the voting process.
The USD price update proposal contract allows each role to cast both an approval and a disapproval vote for the same proposal. This can result in inconsistent and inaccurate counts for approvals and disapprovals, leading to the following issues:
Even if roles are to be trusted,this should still be prevented in case of unforeseen circumstances like the roles losing access to bad actors.
Impact
Roles can manipulate the approval and disapproval counts. Proposals might get approved or disapproved based on inaccurate counts. Also can lead to deletion of correct proposals.
Proof of Concept
Currently the threshold for approvals and disapprovals is 3 which can still change. https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L16-L18
The proposer automatically gets one approval because they approve their own proposal, which indicates there's only 2 approvals left for the proposal to be executed. However
Roles
can first disapprove then approve the proposal which will lead to situations where legitimate proposals are deleted in_execUSDPriceUpdate
function because of the check https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L507-L510This indicates if the approval threshold is met and the disapproval threshold is also met the proposal will get deleted by skipping the price update block https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L506-L528
The current implementation allows a role to disapprove a proposal and approve then it without proper handling, leading to inflated counts for both approvals and disapprovals. https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L177-L207
https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L210-L242
First the
Role
will disapprove since there's a check restricting the role to disapprove if they've already approvedThe
Role
can now callapproveUSDPrice
as there's no restriction stopping them from approving after disapproving the proposal.Recommended Mitigation Steps
To prevent this issue, ensure that each role can only vote once per proposal.
Assessed type
Context