Gala - governance voting API

CertiK9 Aug 2023Code version: not recorded (see the report)

Audit

CertiK reviewed Gala (Gala - governance voting API) on 9 Aug 2023: 2 findings, 1 critical; all marked fixed.

1 critical finding, fixed

Open the report Open Gala’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	0	0	1
Medium	0	0	0
Low	0	0	0

CriticalThe "poll/cast" API allows voting with a negativeFixed

The "poll/cast" endpoint allows users to vote with their voting power. The number of votes the user wants to submit is referred to as the "multiplier" in the request body. Two issues are found regarding the API that, if used together, can allow the voter to have infinite voting power. * Issue 1: When a user supplies a negative "multiplier" in the API call, it will cause the "userVotesUsed" to become a negative number and effectively increase the user's total voting power. * Issue 2: Casting a vote to a non-existing option is allowed. For example, if there are only 3 options to vote on, the user can vote on option 100.

HighUsers can vote on a completed pollFixed

The "poll/cast" endpoint allows users to vote with their voting power. It was found that users can vote on a completed poll and modify the result.