Submitted by Incogknito, also found by 0x23r0, 0xAadi, 0xaudron, 0xmujahid002, 0xvd, anchabadze, Arjuna, aster, BALADOU, bareli, Bizarro, Brene, dreamcoder, eLSeR17, eta, eternal1328, Eurovickk, felconsec, gxh191, hrmneffdii, IceBear, Ishenxx, Lamsy, Manga, muellerberndt, noname_09, Petrus, phaseTwo, Shinobi, sohrabhind, Sparrow, Tamer, Topmark, unnamed, willycode20, and xKeywordx
https://github.com/code-423n4/2025-01-iq-ai/blob/b16b866d4c8d3e4a69b37a02c4e396d4b294537e/src/TokenGovernor.sol#L81-L86
The setProposalThresholdPercentage function in TokenGovernor checks the wrong variable when trying to enforce the maximum 10% threshold limit. Instead of validating the new incoming value, it checks the current stored value, making the protection completely ineffective.
This means anyone can propose and pass a governance proposal that sets the threshold to any value (even 100% or higher), which could effectively break the governance system by making it impossible for token holders to create new proposals.
The impact is severe because:
Attack scenario:
Change the validation to check the new input value instead of the current value:
0xnev (judge) commented:
tom2o17 (IQ AI) confirmed and commented:
0xnev (judge) commented:
tom2o17 (IQ AI) mitigated:
Status: Mitigation confirmed.
For this audit, 18 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by potatoad-sec received the top score from the judge.
The following wardens also submitted reports: 0xAkira, Alekso, dobrevaleri, DoD4uFN, ghost_1911_soap, Greed, HardlyDifficult, inh3l, Ishenxx, K42, KKaminsk, LouisTsai, newspacexyz, phaseTwo, phoenixV110, Sparrow, and Walodja1987.
