Lybra Finance - yjrwkk's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/governance/LybraGovernance.sol#L66-L68 https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/governance/LybraGovernance.sol#L120-L121

Vulnerability details

Impact

In the LybraGovernance contract, the _voteSucceeded function returns true if supportVotes[1] > supportVotes[0]. At the same time in the proposals function supportVotes[0] is returned as forVotes and supportVotes[1] is returned as againstVotes. This could suggest, that probably _voteSucceeded returns in fact true for failed votes (or proposals returns the wrong values`).

Proof of Concept

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/governance/LybraGovernance.sol#L66-L68
https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/governance/LybraGovernance.sol#L120-L121

Recommended Mitigation Steps

diff --git a/contracts/lybra/governance/LybraGovernance.sol b/contracts/lybra/governance/LybraGovernance.sol
index 7b2d4ad..8f566a6 100644
--- a/contracts/lybra/governance/LybraGovernance.sol
+++ b/contracts/lybra/governance/LybraGovernance.sol
@@ -64,7 +64,7 @@ contract LybraGovernance is GovernorTimelockControl {
      * @dev Is the proposal successful or not.
      */
     function _voteSucceeded(uint256 proposalId) internal view override returns (bool){
-        return proposalData[proposalId].supportVotes[1] > proposalData[proposalId].supportVotes[0];
+        return proposalData[proposalId].supportVotes[0] > proposalData[proposalId].supportVotes[1];
     }
 
        /**

Assessed type

Error

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/governance/LybraGovernance.sol#L56-L61

Vulnerability details

Impact

quorumReached does not account for forVotes.

Proof of Concept

The supportVodes mapping of the ProposalExtraData struct consists of three values: forVotes, againstVotes and abstainVotes respectively on keys 0, 1 and 2. The function:

function _quorumReached(uint256 proposalId) internal view override returns (bool){
    return proposalData[proposalId].supportVotes[1] + proposalData[proposalId].supportVotes[2] >= quorum(proposalSnapshot(proposalId));
}

seems to account only for againstVotes and abstainVotes votes, omitting forVotes.

Recommended Mitigation Steps

diff --git a/contracts/lybra/governance/LybraGovernance.sol b/contracts/lybra/governance/LybraGovernance.sol
index 7b2d4ad..2566433 100644
--- a/contracts/lybra/governance/LybraGovernance.sol
+++ b/contracts/lybra/governance/LybraGovernance.sol
@@ -57,7 +57,7 @@ contract LybraGovernance is GovernorTimelockControl {
      * @dev Amount of votes already cast passes the threshold limit.
      */
     function _quorumReached(uint256 proposalId) internal view override returns (bool){
-        return proposalData[proposalId].supportVotes[1] + proposalData[proposalId].supportVotes[2] >= quorum(proposalSnapshot(proposalId));
+        return proposalData[proposalId].supportVotes[0] + proposalData[proposalId].supportVotes[1] + proposalData[proposalId].supportVotes[2] >= quorum(proposalSnapshot(proposalId));
     }
 
        /**

Assessed type

Error