Clear Pending Governance After Completed Transfer of Governance

[hats-bug-reporter[bot]]

Github username: @0xmahdirostami Submission hash (on-chain): 0x964ec7737b8648c2e93847dce5038fb0208bc8e117ebcceb4326486c68449cd6 Severity: low

Description: Description\ The contract uses a two-step process for transferring governance, but after the acceptGovernance function is called, it doesn't delete pending governance.

Impact\ While this vulnerability may not have a significant impact, it is recommended to clear states and follow the rules in the OpenZeppelin Ownable2Step.

Attachments\

1. Proof of Concept (PoC) File

2. Revised Code File (Optional)

   function acceptGovernance() external {
       require(
           pendingGovernance == msg.sender,
           "DappnodeSmoothingPool::acceptGovernance: Only pending governance"
       );
   
       governance = pendingGovernance;
   +       delete pendingGovernance;
       emit AcceptGovernance(pendingGovernance);
   }

[0xmahdirostami]

Revised Code File (Optional)

I didn't consider the event in my report, this is a correct recommended code:

    function acceptGovernance() external {
        require(
            pendingGovernance == msg.sender,
            "DappnodeSmoothingPool::acceptGovernance: Only pending governance"
        );

        governance = pendingGovernance;
        emit AcceptGovernance(pendingGovernance);
+       delete pendingGovernance;
    }

[invocamanman]

I think this issue should be categorized as an informational or recommendation more than a bug. I implemented the other way, since it's more optimal (if it's gonna be transferred more than once). And there's no security issue since the pending governance will match the current governance. The only "damage" that could be caused is that the governance acts "maliciously" and "accepts" the governance multiple times, but this does not damage the system in any way.