Past defeated proposal may get executed when proposal to update to lower quorum votes is passed.

[c4-bot-9]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/GuildGovernor.sol#L98-L103

Vulnerability details

Impact

When a proposal to lower quorum votes is passed. Past proposals may become executable if they had been defeated only due to lack of quorum votes and the number of votes it received past new quorum requirement.

Vulnerability details

Where :- In Governance.sol

• In Governance.sol, when a proposal regarding lowering quorum votes is succeeded and executed.
• All the past proposals that were defeated due to lack of quorum votes suddenly becomes executable.
• This is a high severity issue for 2 reasons :-
  1. As per docs, the team is planning to burn their Guild governance power, which could lead to overhead of making sure no proposals are ever defeated to lack of quorum votes.

  After the beta period, governance powers will be burnt and no further arbitrary code changes possible.
  

  2. Once a proposal is defeated due to lack of quorum votes, governance cannot update quorum until that proposal is expired or defeated or exploitation is fully recoverable.

Proof of Concept

• Openzeppelin security issue - High Severity :
  GHSA-xrc4-737v-9q75

Tools Used

Manual review

Recommended Mitigation Steps

• Keep track of historical quorum values. Openzeppelin specifically added checkpoints to tackle the above mention scenario. Keep track of historical quorum values OpenZeppelin/openzeppelin-contracts#3561
• Maintain a proposalId => QuorumWhenProposed mapping and check state on it's basis.

Assessed type

Governance

[0xSorryNotSorry]

The submission does not provide any demonstration of the issue, reasoning and code blocks.

[c4-pre-sort]

0xSorryNotSorry marked the issue as insufficient quality report

[Trumpero]

invalid proof, OZ 4.9.3 is used for these contracts.

[c4-judge]

Trumpero marked the issue as unsatisfactory:
Invalid