[governance-dao] finalize() refunds config.proposal_threshold from live config not the amount locked at creation — admin can steal proposer deposit by changing config

[nonsobethel0-dev]

Summary

In contracts/governance-dao/src/lib.rs, create_proposal() locks config.proposal_threshold tokens from the proposer. finalize() refunds config.proposal_threshold by reading the live config at finalization time — not the amount that was originally deposited.

Code

create_proposal (line 129): deposits current threshold

gov_token.transfer(&proposer, &env.current_contract_address(), &config.proposal_threshold);

finalize (line 251): refunds current threshold

let config: DaoConfig = env.storage().instance().get(&StorageKey::Config).unwrap();
gov_token.transfer(&env.current_contract_address(), &proposal.proposer, &config.proposal_threshold);
// ↑ uses live config.proposal_threshold, not what was deposited

Attack Scenarios

Scenario A — Admin steals proposer tokens:

1. Proposer locks 1,000 SHIELD at creation (threshold = 1,000)
2. Admin calls update_config setting threshold = 1 (before voting ends)
3. finalize refunds only 1 SHIELD — proposer loses 999 SHIELD

Scenario B — Proposer extracts excess tokens:

1. Proposer locks 100 SHIELD (threshold = 100)
2. Admin raises threshold to 10,000 before finalize
3. finalize attempts to transfer 10,000 SHIELD — will panic if contract has < 10,000

Fix

Store the deposited amount on the Proposal struct at creation and refund that exact amount:

// In Proposal struct
pub deposit: i128,

// In create_proposal
let deposit = config.proposal_threshold;
gov_token.transfer(&proposer, &env.current_contract_address(), &deposit);
let proposal = Proposal { ..., deposit, ... };

// In finalize
gov_token.transfer(&env.current_contract_address(), &proposal.proposer, &proposal.deposit);

Severity: High

[priscannanna85-lgtm]

@priscannanna85-lgtm has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainer I have the knowledge tools and capability to solve the issue. I would like to work on this issue and I will deliver efficiently

ℹ️ Repo Maintainers: To accept this application, review their application or assign @priscannanna85-lgtm to this issue.

[Caneryy]

@Caneryy has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello, I'd like to work on this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Caneryy to this issue.

[prissca]

@prissca has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

i will love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @prissca to this issue.

[drips-wave]

Congratulations, @prissca! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @prissca: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @prissca as part of the Stellar Wave Program's 7th Wave 🥳

😎 @prissca: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.