Platform: Code4rena
Start Date: 14/06/2022
Pot Size: $100,000 USDC
Total HM: 26
Participants: 59
Period: 7 days
Judge: GalloDaSballo
Total Solo HM: 9
Id: 133
League: ETH
Rank: 14/59
Findings: 3
Award: $2,153.79
🌟 Selected for report: 1
🚀 Solo Findings: 2
🌟 Selected for report: codexploder
978.304 USDC - $978.30
6057.6098 CANTO - $978.30
The state function check GovernorBravoDelegate.sol#L115 will always fail since proposalId cannot lie in between initialProposalId and proposalCount due to an initialization in _initiate function
The _initiate function sets initialProposalId = proposalCount;
Now lets say proposal count was 5 so initialProposalId and proposalCount are both set to 5
Now lets say state function is called on proposal id 2
The require condition checks proposalCount >= proposalId && proposalId > initialProposalId
This is equivalent to 5>=2 && 5>5, since 5>5 is not true this always fails even though proposal id 2 is correct
Remove initialProposalId = proposalCount; in the _initiate function
#0 - tkkwon1998
2022-06-22T18:26:08Z
This is a bug, but will not lead to any attack or loss of funds. The initiate function will just fail, meaning the timelock admin cannot be set. This should be a 2 (Med Risk) issue.
#1 - GalloDaSballo
2022-08-10T23:41:25Z
The warden has shown how, due to misconfiguration the Governor contract can be prevented from creating new proposals.
Because this is contingent on setup, I think Medium Severity to be more appropriate
🌟 Selected for report: joestakey
Also found by: 0x1f8b, 0x29A, 0x52, 0xDjango, 0xNazgul, 0xf15ers, 0xmint, Bronicle, Dravee, Funen, JMukesh, Limbooo, MadWookie, Picodes, Ruhum, TerrierLover, TomJ, Tutturu, WatchPug, Waze, _Adam, asutorufos, c3phas, catchup, cccz, codexploder, cryptphi, csanuragjain, defsec, fatherOfBlocks, gzeon, hake, hansfriese, hyh, ignacio, k, nxrblsrpr, oyc_109, robee, sach1r0, saian, simon135, technicallyty, zzzitron
86.0794 USDC - $86.08
687.9945 CANTO - $111.11
Issue: Admin can call setAccountantContract function with address(0) as accountant. This will set admin as address(0) which is wrong
Recommendation: Add below require condition:
require(accountant_!=address(0), "Incorrect address");
Issue: modifier nonReentrant() is never used in CNote.sol
#0 - GalloDaSballo
2022-08-02T01:19:04Z
Valid Low
Valid Refactoring
1 L 1 R