GovernorCountingOverridable allows abstain-only quorum and zero-opinionated-vote pass
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 155
- Forks
- 50
- PR merge metrics
- No merged PRs in 30d
Description
### Summary
[LivepeerGovernor](https://github.com/livepeer/protocol/blob/delta/contracts/treasury/LivepeerGovernor.sol) contract allows proposals with zero opinionated votes to succeed. Moreover, even a proposal with 1 wei "against" and 0 "for" votes can succeed if it reaches quorum via "abstain" votes.
### Root causes
- Rounding down is introduced when calculating [MathUtils.percOf(opinionatedVotes, quota)](https://github.com/livepeer/protocol/blob/6e6b452634542ff92b93643196a97ff356bac230/contracts/treasury/GovernorCountingOverridable.sol#L125C28-L125C69).
- The `>=` equation used to compare `forVotes` with the quorum-adjusted `opinionatedVotes` evaluates to, for example, `0 >= 0`, and therefore results in `_voteSucceeded` returning `true`.
### Why it's not an issue
- Using "abstain" votes to reach a quorum is known and expected behavior.
- The rounding issue has an impossibly low likelihood of being exploitable: the enforced voting period ([currently set to 10 rounds](https://arbiscan.io/address/0xcFE4E2879B786C3aa075813F0E364bb5acCb6aa0#readProxyContract#F32)) gives all participants sufficient time to cast opinionated votes and prevent any malicious proposal from passing.
- The issue is mitigated in real life by having as few as 2 wei more "against" votes than "for" votes.
### Out of scope for bug bounty
Reports targeting [GovernorCountingOverridable._voteSucceeded](https://github.com/livepeer/protocol/blob/6e6b452634542ff92b93643196a97ff356bac230/contracts/treasury/GovernorCountingOverridable.sol#L119) via abstain-only voting, zero-opinionated voting, or equal for/against voting are closed as known issues and not eligible for rewards under the [Livepeer Immunefi bug bounty program](https://immunefi.com/bug-bounty/livepeer/information/).
### References
- Source: [contracts/treasury/GovernorCountingOverridable.sol](https://github.com/livepeer/protocol/blob/delta/contracts/treasury/GovernorCountingOverridable.sol)
- Deployed LivepeerGovernor Proxy (Arbitrum): [0xcFE4E2879B786C3aa075813F0E364bb5acCb6aa0](https://arbiscan.io/address/0xcFE4E2879B786C3aa075813F0E364bb5acCb6aa0)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with contracts/treasury/GovernorCountingOverridable.sol, especially _voteSucceeded around line 119 and the MathUtils.percOf calculation around line 125. The report describes known, out-of-scope behavior but gives no requested change, test path, or acceptance criterion, so the intended fix and definition of done are unresolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100