Canto contest - dipp's results

Lines of code

GovernorBravoDelegate.sol#L63

Vulnerability details

Impact

In GovernorBravoDelegate.sol's queue function, the executed value for the proposal to be queued is set to true. The execute function in GovernorBravoDelegate.sol will revert when called since the state of the proposal is Executed.

Proof of Concept

1. In queue, a proposal with id == proposalId is fetched from the unigov map contract. If the proposal is formed correctly, does not exist in the GovernorBravoDelegate's proposals variable and is not queued then it is added to proposals with its executed value set to true.

2. When execute is called it checks state(proposalId) == ProposalState.Queued. Since proposals[proposalId].executed == true, execute will revert and the proposal corresponding to proposalId will not be executed.

Recommended Mitigation Steps

In the queue function, when adding the newProposal set executed to false in line 63.