Submitted by hyh
ERC721Votess delegate() and delegateBySig() allow the delegation to zero address, which result in owners votes elimination in the checkpoint. I.e. the votes are subtracted from the owner, but arent added anywhere. _moveDelegateVotes() invoked by _delegate() treats the corresponding call as a burning, erasing the votes.
The impact is that the further transfer and burning attempts for the ids of the owner will be reverted because _afterTokenTransfer() callback will try to reduce owners votes, which are already zero, reverting the calls due to subtraction fail.
As ERC721Votes is parent to Token the overall impact is governance token burning and transfer being disabled whenever the owner delegated to zero address. This can be done deliberately, i.e. any owner can disable burning and transfer of the owned ids at any moment, which can interfere with governance voting process.
User facing delegate() and delegateBySig() allow for zero address delegation:
https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/lib/token/ERC721Votes.sol#L131-L135
https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/lib/token/ERC721Votes.sol#L144-L174
And pass zero address to the _delegate() where it is being set:
https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/lib/token/ERC721Votes.sol#L179-L190
In this case _moveDelegateVotes() will reduce the votes from the owner, not adding it to anywhere as _from is the owner, while _to is zero address:
https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/lib/token/ERC721Votes.sol#L203-L220
The owner might know that and can use such a delegation to interfere with the system by prohibiting of transferring/burning of his ids.
This happens via _afterTokenTransfer() reverting as its becomes impossible to reduce owners votes balance by 1:
https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/lib/token/ERC721Votes.sol#L262-L271
Consider prohibiting zero address as a delegation destination:
https://github.com/code-423n4/2022-09-nouns-builder/blob/7e9fddbbacdd7d7812e912a369cfd862ee67dc03/src/lib/token/ERC721Votes.sol#L179-L190
When _to isnt zero there always be an addition in _moveDelegateVotes(), so the system votes balance will be sustained.
Alex the Entreprenerd (judge) decreased severity to Medium and commented:
iainnash (Nouns Builder) confirmed and commented:
