Attacker can manipulate user's delegate address

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/crowdfund/InitialETHCrowdfund.sol#L302
https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/party/PartyGovernanceNFT.sol#L194-L200

Vulnerability details

Vulnerability Details

When a user contributes in crowdfund for the first time a nft will be minted and voting power will be delegated to delegate address provided by contributor but if it's not first contribution , delegate address won't be changed so attacker can front-run user contribution and perform contributeFor with desired delegate address and a low contribution amount , since delegate is configured in previous transaction when contribute is performed the delegate address provided by attacker won't be changed so attacker can benefit from delegated voting power to optional address .

Impact

Attackers benefit from free voting power

Proof of Concept

1 - user calls contribute for the first time and provides an address to delegate voting power
2 - attacker front-runs contribute and calls contributeFor and provides his own address as delegate
3 - delegate is configured in previous transaction so contribute doesn't change delegate address
4 - attacker use delegated voting power

Tools Used

Manual Review

Recommended Mitigation Steps

prevent providing delegate address in contributeFor function

Assessed type

Other

[ydspa]

Insufficient proof

Invalid

[c4-pre-sort]

ydspa marked the issue as insufficient quality report

[c4-judge]

gzeon-c4 changed the severity to 2 (Med Risk)

[c4-judge]

gzeon-c4 marked the issue as duplicate of #418

[c4-judge]

gzeon-c4 marked the issue as partial-50

[c4-judge]

gzeon-c4 marked the issue as satisfactory

[c4-judge]

gzeon-c4 marked the issue as partial-50