Governance relies on current totalSupply of bHermes when calculate proposalThresholdAmount and quorumVotesAmount

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/governance/GovernorBravoDelegateMaia.sol#L87-L93

Vulnerability details

Impact

As people mint bHermes, bHermesVotes' totalSupply grows. And quorumVotesAmount to execute proposal also grows. But it shouldn't, because new people can't vote for it. This behavior adds inconsistency to voting process, because changes threshold after creating proposal.

Proof of Concept

Here you can see that Governance fetches current totalSupply:
https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/governance/GovernorBravoDelegateMaia.sol#L87-L93

    function getProposalThresholdAmount() public view returns (uint256) {
        return govToken.totalSupply() * proposalThreshold / DIVISIONER;
    }

    function getQuorumVotesAmount() public view returns (uint256) {
        return govToken.totalSupply() * quorumVotes / DIVISIONER;
    }

bHermes is ERC4626DepositOnly and mints new govToken when user calls deposit() or mint(), thus increasing totalSupply:
https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/hermes/bHermes.sol#L123-L133

    function _mint(address to, uint256 amount) internal virtual override {
        gaugeWeight.mint(address(this), amount);
        gaugeBoost.mint(address(this), amount);
        governance.mint(address(this), amount);
        super._mint(to, amount);
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Add parameter totalSupply to Proposal struct and use it instead of current totalSupply in functions getProposalThresholdAmount() and getQuorumVotesAmount()

Assessed type

Governance

[c4-judge]

trust1995 marked the issue as primary issue

[c4-judge]

trust1995 marked the issue as satisfactory

[c4-sponsor]

0xLightt marked the issue as sponsor confirmed

[c4-judge]

trust1995 marked issue #180 as primary and marked this issue as a duplicate of 180

[0xLightt]

I believe this is valid as it is something we want to address (save the totalSupply at the time of the creation of every proposal) and it is not a duplicate of #180.

[c4-judge]

trust1995 marked the issue as not a duplicate

[c4-judge]

trust1995 marked the issue as selected for report

[0xLightt]

Addressed https://github.com/Maia-DAO/eco-c4-contest/tree/179