Lybra Finance - zambody's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/governance/LybraGovernance.sol#L60

Vulnerability details

Impact

For votes are not counted in quorum. Proposals could fail to reach quorum if a majority of the votes are for.

Proof of Concept

function _quorumReached(uint256 proposalId) internal view override returns (bool){
    return proposalData[proposalId].supportVotes[1] + proposalData[proposalId].supportVotes[2] >= quorum(proposalSnapshot(proposalId));
}

This code does not count "for" votes.

Tools Used

GitHub

Recommended Mitigation Steps

Add the for votes:

function _quorumReached(uint256 proposalId) internal view override returns (bool){
    return proposalData[proposalId].supportVotes[0] + proposalData[proposalId].supportVotes[1] + proposalData[proposalId].supportVotes[2] >= quorum(proposalSnapshot(proposalId));
}

Assessed type

Error