MELD security record

In the contract `MeldDaoERC721` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below.  Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and: - function setNftPrice(), to change the value of `nftPrice` which is the `MeldToken` amount to buy the voting NFT. - function setRedemptionFee(), to change the `redemptionFee` which is the fee amount when redeeming the voting NFT back to the `MeldToken`. - function setFeeAddress(), to change the addresses `feeAddress` to receive the redemption fee. - function setDaoAddress(), to change the address `daoAddress` which can call the function `updateRedeemableTimestamp()` to change the redeemable timestamp. - function setURI(), to change the NFT uri. - function withdrawMeldTokens(), to withdraw the Meld tokens that were wrongfully locked in this contract. - function rescueERC20(), to transfer ERC20 tokens except for MeldToken in the contract to any address - function rescueERC721(), to transfer any type of ERC721 tokens in the contract to any address - function rescueERC1155(), to transfer any type of ERC1155 tokens in the contract to any address In the contract `MeldDaoERC721` the role `daoAddress` has authority over the functions shown in the diagram below.  Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and: - function `updateRedeemableTimestamp()`, to change the redeemable timestamp. In the contract `MeldVotingContract`, the role `adminRolePerDao[dao]` has authority over the following functions: - function setMaxDelegatesPerNft(), to set the maximum number of delegates per NFT. Also, the role `registered adapters` has authority over the following functions: - function configureDao(), to configure the `MeldVotingContract` setting the associated `MeldDaoERC721` address, admin roles and `maxDelegatesPerNft`. - function startNewVotingForProposal(), to start a new voting proposal considering the block time and number. In the contract `MeldProposalInitializerContract`, the role `adminRolePerDao[dao]` has authority over the following functions: - function setCanAnyonePropose(), to change the flag that allows anyone to propose. - function setMinVotingPeriod(), to set the minimum voting period. - function setMaxVotingPeriod(), to set the maximum voting period. Also, the role `registered adapters` has authority over the following functions: - function configureDao(), to configure the `MeldProposalInitializerContract` setting the associated `dao` address, admin and proposal creator roles, `minVotingPeriod`, and `maxVotingPeriod`. The contracts `DaoFactory` and `DaoRegistry` allow several initial members like the contract deployer, specific `creator`, and `payer` to set up the DAO configurations and take complete control over the DAO. For example: - function addAdapters(), to add adapters and sets their ACL flag to grant specific operation privileges. - function configureExtension(), to configure the extension to set the ACL flag. - function updateAdapter(), to replace an adapter with a new one. - function replaceAdapter(), to replace an adapter with a new one. - function finalizeDao(), to set the state of the DAO to READY. - function setConfiguration(), to change the `mainConfiguration` value. - function setAddressConfiguration(), to change the `addressConfiguration` value. - function addExtension(), to add a new extension to the DAO registry. - function removeExtension(), to remove an adapter from the registry. - function setAclToExtensionForAdapter(), to set the ACL flags to an adapter to make it possible to access specific functions of an Extension. - function submitProposal(), to submit proposals to the DAO registry. - function sponsorProposal(), to sponsor proposals submitted to the DAO registry. - function jailMember(), to mark a member as jailed. - function unjailMember(), to mark a member as not jailed. - function potentialNewMember(), to register a member address in the DAO. - function updateDelegateKey(), to update the delegate key of a member. Once the function `finalizeDao()` is called, only registered adapters and extensions with the specific ACL flag can call the privileged functions. According to the feedback from the development team, some of the functionalities are not used in the current project and the actual usages may be different.

In the function `voteResult()`, the voting result is only based on the number of YES and NO votes without considering the total amount of votes, namely the quorum. As a result, a malicious user could potentially submit a proposal with a random proposal ID and minimum voting period, and other users may not notice this. And this vote may pass because only the malicious user participate and voted yes.

The variable `_trustedForwarder` serves as a 3rd party forwarder to help the `ERC2771Recipient` identify the address of the transaction signer. `BaseToken` and `MeldToken` inherit `ERC2771Recipient`, which decodes the `msg.sender` from `msg.data` when called from the forwarder by overriding the `_msgSender()` function. A malicious forwarder may forge the value of _msgSender() and effectively send transactions from any address. The scope of the audit treats these 3rd party forwarders as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts. Reference: [EIP-2771](https://eips.ethereum.org/EIPS/eip-2771)