VetoProposal.voteToVeto() checks the proposal status wrongly.

[code423n4]

Lines of code

https://github.com/code-423n4/2023-04-party/blob/440aafacb0f15d037594cebc85fd471729bcb6d9/contracts/proposals/VetoProposal.sol#L33

Vulnerability details

Impact

VetoProposal.voteToVeto() wouldn't work as expected because voters can vote during the Voting status only.

Proof of Concept

When we check veto(), it works during 3 statuses, Voting, Passed, Ready which is mentioned in the comment as well.

    {
        ProposalStatus status = _getProposalStatus(values);
        // Proposal must be in one of the following states.
        if (
            status != ProposalStatus.Voting &&
            status != ProposalStatus.Passed &&
            status != ProposalStatus.Ready
        ) {
            revert BadProposalStatusError(status);
        }
    }

But voteToVeto() works during the Voting status only.

    (
        PartyGovernance.ProposalStatus proposalStatus,
        PartyGovernance.ProposalStateValues memory proposalValues
    ) = party.getProposalStateInfo(proposalId);
    if (proposalStatus != PartyGovernance.ProposalStatus.Voting) //@audit why Voting only?
        revert ProposalNotActiveError(proposalId);

As veto() should be executed after checking the passThresholdBps in voteToVeto(), veto() would work on Voting status only.

Tools Used

Manual Review

Recommended Mitigation Steps

voteToVeto() should work during Voting, Passed, Ready statuses.

[0xean]

Will leave open for sponsor review, this may be as designed.

[c4-judge]

0xean marked the issue as primary issue

[0xble]

This is valid, proposals should be allowed to be vetoed even after they've passed but have not yet been executed.

[c4-sponsor]

0xble marked the issue as sponsor confirmed

[c4-judge]

0xean marked the issue as satisfactory

[c4-judge]

0xean marked issue #3 as primary and marked this issue as a duplicate of 3