onlyOneOfRoles able to disapprove a proposal then approve after. this will cause inconsistency in the protocol between approvals and disapprovals.
Proof of Concept
There is no check for a proposal if it's already disapproved in approveUSDPrice, while there is a check at L226
if (usdUpdateProposal.approvals[msg.sender] == _usdProposalId)
revert ProposalAlreadyApprovedError();
in disapproveUSDPrice method if a proposal already approved.
This would cause inconsistency in the protocol and could cause a negative impact. and can affect _execUSDPriceUpda as could cause unfair votes for the participants.
Tools Used
Manual Review
Recommended Mitigation Steps
Check if the proposal already disapproved in approveUSDPrice method.
Lines of code
https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L226
Vulnerability details
Impact
onlyOneOfRoles able to disapprove a proposal then approve after. this will cause inconsistency in the protocol between approvals and disapprovals.
Proof of Concept
There is no check for a proposal if it's already disapproved in approveUSDPrice, while there is a check at L226
in
disapproveUSDPrice
method if a proposal already approved.This would cause inconsistency in the protocol and could cause a negative impact. and can affect _execUSDPriceUpda as could cause unfair votes for the participants.
Tools Used
Manual Review
Recommended Mitigation Steps
Check if the proposal already disapproved in
approveUSDPrice
method.Assessed type
Other