Party DAO - cccz's results

Lines of code

https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/proposals/SetGovernanceParameterProposal.sol#L25-L66

Vulnerability details

Impact

In the current implementation, the proposal may call _executeSetGovernanceParameter to change the governanceValues, which include voteDuration, executionDelay, and passThresholdBps, and since they are used to determine the status of the proposal, when they are changed, the status of other proposals may be changed. For example, if executionDelay decreases, other proposals may expire. If voteDuration decreases, the status of other proposals in voting may change to Defeated

        uint40 t = uint40(block.timestamp);
        GovernanceValues memory gv = _getSharedProposalStorage().governanceValues;
        if (pv.passedTime != 0) {
            // Ready.
            if (pv.passedTime + gv.executionDelay <= t) {
                return ProposalStatus.Ready;
            }
            // If unanimous, we skip the execution delay.
            if (_isUnanimousVotes(pv.votes, pv.totalVotingPower)) {
                return ProposalStatus.Ready;
            }
            // If all hosts voted, skip execution delay
            if (_hostsAccepted(pv.numHosts, pv.numHostsAccepted)) {
                return ProposalStatus.Ready;
            }

Proof of Concept

https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/proposals/SetGovernanceParameterProposal.sol#L25-L66

Tools Used

None

Recommended Mitigation Steps

It is recommended to add voteDuration, executionDelay, and passThresholdBps fields in ProposalStateValues structure to cache governanceValues when propose.

Assessed type

Context