Party DAO - ast3ros's results

Lines of code

https://github.com/code-423n4/2023-10-party/blob/06e6271b75a30f00ae2674e8c26f3eb9e89e75e5/contracts/party/PartyGovernance.sol#L1097-L1100

Vulnerability details

Impact

One host can allow a proposal to skip execution delay without all host accepted. The host role responsibility is defined below, it should now allow to bypass without full host consensus.

    Hosts: A role in the Party for trusted addresses that grants the ability to unilaterally veto proposals in the Party and configure Rage Quit. Each Host may or may not be a member (i.e. have non-zero voting power in the Party).

Proof of Concept

When getting the status of a proposal, there is a case when if all hosts vote for a proposal, the propsal can skip the execution delay and can be called right away.

    // If all hosts voted, skip execution delay
    if (_hostsAccepted(pv.numHosts, pv.numHostsAccepted)) {
        return ProposalStatus.Ready;
    }

https://github.com/code-423n4/2023-10-party/blob/06e6271b75a30f00ae2674e8c26f3eb9e89e75e5/contracts/party/PartyGovernance.sol#L1097-L1100

However, the check can be bypass and one host can allow the skip of execution instead of all hosts. In accept function, when an account vote for a proposal, the msg.sender is checked if it is a host, then it increases the number of host accepted by one.

    if (isHost[msg.sender]) {
        ++values.numHostsAccepted;
    }

There is function abdicateHost that allow transfering host status to another account. A host can just transfer to another if its address and call accept again, artificially inflating the count of accepting hosts, and bypass the check.

    /// @notice Transfer party host status to another.
    /// @param newPartyHost The address of the new host.
    function abdicateHost(address newPartyHost) external {
        _assertHost();
        // 0 is a special case burn address.
        if (newPartyHost != address(0)) {
            // Cannot transfer host status to an existing host.
            if (isHost[newPartyHost]) {
                revert InvalidNewHostError();
            }
            isHost[newPartyHost] = true;
        } else {
            // Burned the host status
            --numHosts;
        }
        isHost[msg.sender] = false;
        emit HostStatusTransferred(msg.sender, newPartyHost);
    }

Tools Used

Manual

Recommended Mitigation Steps

Implement a snapshot mechanism of host status at the time of proposal creation to ensure that only the hosts at the time can contribute to the acceptance count, preventing manipulation by host role transfer.

Assessed type

Other