audit: Potential Reentrancy in executeQueuedProposal Method (#215)

* chore: comment explaining possible reentrancy * :chore: reentrancy example --------- Co-authored-by: Orlando <[email protected]>
snapshot-labs · Jun 20, 2023 · 56409d5 · 56409d5
1 parent 873097a
commit 56409d5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/src/execution-strategies/CompTimelockCompatibleExecutionStrategy.sol b/src/execution-strategies/CompTimelockCompatibleExecutionStrategy.sol
@@ -137,6 +137,10 @@ contract CompTimelockCompatibleExecutionStrategy is SimpleQuorumExecutionStrateg
 
     /// @notice Executes a queued proposal.
     /// @param payload The encoded payload of the proposal to execute.
+    /// @dev Due to possible reentrancy, one cannot rely on the invariant that proposal payloads are executed atomically.
+    ///      As follows: If Proposal A is composed of MetaTransaction a1 and a2, and proposal B of MetaTransaction b1.
+    ///      If A.a1 executes code that triggers a proposal execution, then the execution order overall can potentially
+    ///      become [A.a1, B.b1, A.a2].
     function executeQueuedProposal(bytes memory payload) external {
         bytes32 executionPayloadHash = keccak256(payload);
 

diff --git a/src/execution-strategies/TimelockExecutionStrategy.sol b/src/execution-strategies/TimelockExecutionStrategy.sol
@@ -143,6 +143,10 @@ contract TimelockExecutionStrategy is SimpleQuorumExecutionStrategy, IERC1155Rec
 
     /// @notice Executes a queued proposal.
     /// @param payload The proposal execution payload.
+    /// @dev Due to possible reentrancy, one cannot rely on the invariant that proposal payloads are executed atomically.
+    ///      As follows: If Proposal A is composed of MetaTransaction a1 and a2, and proposal B of MetaTransaction b1.
+    ///      If A.a1 executes code that triggers a proposal execution, then the execution order overall can potentially
+    ///      become [A.a1, B.b1, A.a2].
     function executeQueuedProposal(bytes memory payload) external {
         bytes32 executionPayloadHash = keccak256(payload);