Council Members can repeatedly challenge every proposal.

Summary

Council Members can grief the proposal by creating many proposals and challenging every proposal.

Vulnerability Detail

Council Members are only semi-trusted members. They can decide to challenge every proposal, which means that every proposal that is proposed gets rejected.

    function challengeTransaction(
        uint256 transactionId
    ) external onlyCouncilMember whenNotPaused {
        // Makes sure the id exists
        require(
            transactionId < proposedTransactions.length,
            "TelcoinDistributor: Invalid index"
        );

        // Reverts if the current time exceeds the sum of the transaction's timestamp and the challenge period
        require(
            block.timestamp <=
                proposedTransactions[transactionId].timestamp + challengePeriod,
            "TelcoinDistributor: Challenge period has ended"
        );

        // Sets the challenged flag of the proposed transaction to true
        proposedTransactions[transactionId].challenged = true;

        // Emits an event with the transaction ID and the challenger's address
        emit TransactionChallenged(transactionId, _msgSender());

It is very easy for the council member to grief the protocol.

Additionally, the council member can create many spam proposals to disrupt the protocol.

Impact

Council member can challenge all proposals and create spam proposals.

Code Snippet

https://github.com/sherlock-audit/2024-01-telcoin-cryptostaker2/blob/475e5c92315d0b6cc1aa185a856fb8c24d993040/telcoin-audit/contracts/protocol/core/TelcoinDistributor.sol#L115-L135

Tool used

Manual Review

Recommendation

Since council members are not fully trusted, protocol should have more protection for the proposing and challenging functions. For proposals, every council member can only propose one proposal every 24 hours, to prevent spam. Challenging proposals must require 2 or more council member for the proposal to succeed, to prevent one council member from griefing every proposals.

Duplicate of #142

sherlock-audit / 2024-01-telcoin-judging

Jaraxxus - Council Members can repeatedly challenge every proposal. #192