Ajna Protocol - circlelooper's results

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-grants/src/grants/base/StandardFunding.sol#L441

Vulnerability details

Impact

Proposals with 0 funding votes are allowd to be updated in slate.

Proof of Concept

Winning proposals from screening stage will be voted upon in funding stage, then in the following challenge period, user can submit proposalIds in slate, if the sum of funding votes received by the proposals is higher than that of the existing slate, the top slate will be update to the new slate, proposals in the top slate are expected to be executed. In StandardFunding.sol, _validateSlate() is used to check if the submitted proposals is valid and to calculate the sum of funding votes. However, it does not check if any of the proposal received 0 funding votes, so it's possible that even if a proposal gets no funding vote, it may still be updated in slate and be executed after challenge period.

            if (proposal.fundingVotesReceived < 0) revert InvalidProposalSlate();

Tools Used

Manual Review

Recommended Mitigation Steps

Proposals with 0 funding votes should not be updated in slate, please refer to the following fix:

            if (proposal.fundingVotesReceived <= 0) revert InvalidProposalSlate();

Assessed type

Access Control