EGP #005 InflationRootHashProposal Upgrade 2

Eco Governance Proposals [EGP's]
1

This post briefly summarizes the Eco Governance Proposal submitted on Jan 12, 2023. This proposal patches a bug in Random Inflation and adds more robust checks around claiming proposal fees when submitting Random Inflation.

Summary

The vulnerability patched is in the InflationRootHashProposal.sol contract that oversees the process of submitting the Merkle tree for distributing rewards for Random inflation. A submission on Immunefi alerted us to an issue in the checkRootHashStatus method, which is intended to be used to mark a root hash proposal as being accepted after the challenge period has ended. The bug indicated that the status of an address’ root hash proposal could be locked in before the proposal was submitted. This would cause any challenges to this malicious Merkle tree to revert. The submission of a malicious root hash after this status check would jeopardize the integrity of the random inflation process, and subvert the checks put in place to make it equitable. The fix we implemented demands that the input address to checkRootHashStatus has properly submitted a root hash proposal, and causes other calls to the method to fail. We also reinforced similar checks on other methods, such as claimFee.

9 Likes
2

Full support, we should patch vulnerabilities and bugs as soon as possible and give it a top priority.

1 Like
3

Oh my God :astonished:, we need to fix this right away.

4

totally in! agree with Olga, needs to be fixed asap

1 Like
5

I fully support any proposals to fix bugs.

6

Based on clear support for this proposal from the community, the Association submitted support with its full voting power (based on its holdings and delegations to it). We expect this will satisfy the support threshold and kick off the 3-day voting period.

2 Likes
7

Based on clear support for this proposal from the community, the Association will vote in favor with its full voting power (based on its holdings and delegations to it). We expect this will result in the approval of EGP #005 Inflation RootHashProposal Upgrade 2.

8

This proposal has been passed successfully by the Eco Community and will be implemented by the Eco Protocol in Generation 1007. This post is being closed for comments as it is no longer an active topic.

1 Like