Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

audit: Multiple Voting if Voting Strategy Calls Untrusted Code #183

Closed
Orland0x opened this issue Jun 13, 2023 · 1 comment · Fixed by #211
Closed

audit: Multiple Voting if Voting Strategy Calls Untrusted Code #183

Orland0x opened this issue Jun 13, 2023 · 1 comment · Fixed by #211
Assignees

Comments

@Orland0x
Copy link
Contributor

There is a possible reentrancy in the vote method of a Space. If the voting strategy calls untrusted code, vote() can be reentered and a user can vote several times, because the voteRegistry is updated only after the interactions (vote counting and incrementing) have happened.

@pscott pscott self-assigned this Jun 16, 2023
@pscott
Copy link
Collaborator

pscott commented Jun 16, 2023

Even though we do trust the voting strategies, it's still better to prevent this bug.

FIX: move voteRegistry[proposalId][voter] = true to before the call to _getCumulativePower

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants