While the only ERC20 token that the contract interacts with is the designated token with voting capability, if the token does not revert on failed transfer (e.g. transfer exceeds balance), then anyone can infinitely mint the ERC1155 token. This can be extended into a honeypot attack vector that can steal funds from successful transfers.
POC:
Alice can be aware of Bobs delegatee by simply front-running.
We recognize this as a low severity issue because, while the impact is high, we could not identify such a token with both voting capability and doesnt revert on failed transfer. However, we do not rule out the possibility that such a token does exist.
The recommended mitigation method is to use OpenZeppelins safeTransfer.
