livepeer / livepeer/protocol

GovernorCountingOverridable allows abstain-only quorum and zero-opinionated-vote pass

Open
#654 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

known-issue
Dominant language
JavaScript
Stars
155
Forks
50
PR merge metrics
No merged PRs in 30d

Description

### Summary

[LivepeerGovernor](https://github.com/livepeer/protocol/blob/delta/contracts/treasury/LivepeerGovernor.sol) contract allows proposals with zero opinionated votes to succeed. Moreover, even a proposal with 1 wei "against" and 0 "for" votes can succeed if it reaches quorum via "abstain" votes.

### Root causes

- Rounding down is introduced when calculating [MathUtils.percOf(opinionatedVotes, quota)](https://github.com/livepeer/protocol/blob/6e6b452634542ff92b93643196a97ff356bac230/contracts/treasury/GovernorCountingOverridable.sol#L125C28-L125C69).
- The `>=` equation used to compare `forVotes` with the quorum-adjusted `opinionatedVotes` evaluates to, for example, `0 >= 0`, and therefore results in `_voteSucceeded` returning `true`.

### Why it's not an issue

- Using "abstain" votes to reach a quorum is known and expected behavior.
- The rounding issue has an impossibly low likelihood of being exploitable: the enforced voting period ([currently set to 10 rounds](https://arbiscan.io/address/0xcFE4E2879B786C3aa075813F0E364bb5acCb6aa0#readProxyContract#F32)) gives all participants sufficient time to cast opinionated votes and prevent any malicious proposal from passing.
- The issue is mitigated in real life by having as few as 2 wei more "against" votes than "for" votes.

### Out of scope for bug bounty

Reports targeting [GovernorCountingOverridable._voteSucceeded](https://github.com/livepeer/protocol/blob/6e6b452634542ff92b93643196a97ff356bac230/contracts/treasury/GovernorCountingOverridable.sol#L119) via abstain-only voting, zero-opinionated voting, or equal for/against voting are closed as known issues and not eligible for rewards under the [Livepeer Immunefi bug bounty program](https://immunefi.com/bug-bounty/livepeer/information/).

### References

- Source: [contracts/treasury/GovernorCountingOverridable.sol](https://github.com/livepeer/protocol/blob/delta/contracts/treasury/GovernorCountingOverridable.sol)
- Deployed LivepeerGovernor Proxy (Arbitrum): [0xcFE4E2879B786C3aa075813F0E364bb5acCb6aa0](https://arbiscan.io/address/0xcFE4E2879B786C3aa075813F0E364bb5acCb6aa0)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with contracts/treasury/GovernorCountingOverridable.sol, especially _voteSucceeded around line 119 and the MathUtils.percOf calculation around line 125. The report describes known, out-of-scope behavior but gives no requested change, test path, or acceptance criterion, so the intended fix and definition of done are unresolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
blockchain, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.