Governance.sol
Receipt demovak0 · 2026-05-15 20:28 UTC
68/100
5 findings
Critical
1
flagged
High
2
flagged
Medium
0
Low
1
flagged
Info
1
flagged
- CRITICALSuspiciouspattern matchcp-hack-beanstalk-instant-governance· Governance.sol:8
Beanstalk hack pattern — governance execute() with no timelock between vote and call
A governance contract exposes an execute() / executeProposal() / propose() function callable in the same block as voting. This is the exact $182M Beanstalk vector (April 2022): an attacker flash-loaned the governance token, voted yes on a self-draining proposal, and called execute() in the same transaction. A timelock between successful vote and execution would have made the flash-loan economically pointless.
Fix: Add a queue/execute split: successful proposals enter a TimelockController with a minimum delay (24-48h is standard). Require execute() to verify block.timestamp >= queuedAt + delay. Never let voting power, proposal acceptance, and code execution happen atomically. - HIGHSuspiciouspattern matchcp-sol-unchecked-call· Governance.sol:11
Unchecked low-level call return value
Low-level call() returns a boolean success flag. Ignoring it can silently swallow failures.
Fix: Always check the return value: `(bool success, ) = addr.call{...}(...); require(success);` - HIGHSuspiciouspattern matchcp-hack-cream-spot-share-pricing· Governance.sol:10
Cream hack pattern — collateral price computed from spot vault share supply
A function computes a token/share price by dividing total assets by spot totalSupply (or balanceOf this). The $130M Cream hack (Oct 2021) exploited exactly this on yUSDVault: flash-loan inflated the share supply during a single tx, the price oracle read the manipulated value, and the attacker borrowed massively against fictitious collateral. Spot supply/balance ratios are flash-loan-attackable.
Fix: Use Chainlink price feeds with staleness checks, a TWAP from a deep Uniswap V3 pool, or external collateral-pricing oracles. Never compute price from same-block totalSupply or balanceOf. - LOWSuspiciouspattern matchcp-sol-floating-pragma· Governance.sol:2
Floating pragma — unlocked compiler version
Using `pragma solidity ^` allows compiling with different versions, which may introduce inconsistent behavior or known bugs.
Fix: Lock the pragma to a specific version (e.g. `pragma solidity 0.8.24;`) for production contracts. - INFOSuspiciouspattern matchcp-sol-missing-event· Governance.sol:8
State change without event emission
State-changing functions should emit events for off-chain indexing. Best practice for indexers and UI, not a security vulnerability — flagged informationally.
Fix: Add an event emission after state changes if downstream indexers / UI need to track them.
Share this receipt
https://elytrasec.io/r/demovak0
Receipts are snapshots — findings may change as the engine improves.
Want a deeper scan? Run via x402 API or re-scan in the playground.