Nouns Builder contest - hxzy's results

Lines of code

https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/lib/token/ERC721Votes.sol#L196-L235 https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/lib/token/ERC721.sol#L125-L151

Vulnerability details

Impact

If this project relies on the voting results in the Token contract in governance, it may cause some malicious accounts to obtain malicious votes, thereby affecting the results of governance.

Proof of Concept

As shown in the picture in the link: https://photos.app.goo.gl/F4fWny2gStRbNkQa6 The total token supply is 2, but the 0x17F6 address gets 4 votes. How to reproduce the problem: Use an account that holds Token tokens and call delegates or delegateBySig functions to vote for the specified address. After the voting is completed, call the safeTransferFrom function to transfer all the Tokens in the above account to another account, and then the new account will call the delegates or delegateBySig function to vote to the above specified address. At this point, it can be found that the number of votes held by the above designated address is twice the number of Tokens used in the appeal. If you keep transferring Tokens and then calling the delegates function, theoretically, the number of votes held by the specified address can be turned into a maximum value.

Tools Used

Remix, VS code

Recommended Mitigation Steps

When calling the safeTransferFrom function, call the _moveDelegateVotes function at the same time to update the valid votes.