Two identical calls in one proposal not possible #57
Labels
bug
Something isn't working
disagree with severity
Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments)
duplicate
This issue or pull request already exists
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
Lines of code
https://github.com/code-423n4/2022-08-nounsdao/blob/c1c7c6201d0247f92472419ff657b570f9104565/contracts/governance/NounsDAOLogicV2.sol#L313
Vulnerability details
Impact
Because
queueOrRevertInternal
reverts when the same call (same target, value, data, signature, eta) is already queued, it is not possible to have the same call two times in the same proposal, which can be limiting for some applications.Proof Of Concept
There is an auction contract for a token with a
buy()
function. Because the function does not accept an amount parameter, the user has to call it multiple times when he wants to buy multiple tokens.Alice creates a proposal to buy two of those tokens, i.e. a proposal that has two times exactly the same call. The proposal succeeds and she wants to queue it. However, this reverts and the Nouns DAO does not get this awesome new token.
Recommended Mitigation Steps
Allow the same call multiple times (in the same proposal) or introduce a
times
parameter to indicate how many times the contract should be called.The text was updated successfully, but these errors were encountered: