[governance-dao] update_config can change total_supply mid-vote — quorum calculation in finalize() uses new supply, invalidating ongoing proposals

[nonsobethel0-dev]

Summary

contracts/governance-dao/src/lib.rs stores total_supply inside DaoConfig in instance storage. Admin can call update_config() at any time, including during an active vote. finalize() reads config.total_supply at finalization time to compute quorum, not the supply at proposal creation.

Code

finalize (line 229–232):

let config: DaoConfig = env.storage().instance().get(&StorageKey::Config).unwrap();
let total_supply = config.total_supply;  // ← reads CURRENT supply
let quorum_needed = total_supply * config.quorum_bps as i128 / 10_000;

Attack Scenarios

Reducing quorum to force a pass:

1. Proposal is active; votes_for = 500, total_supply = 10,000 (quorum = 1,000 → proposal fails)
2. Admin calls update_config setting total_supply = 5,000
3. quorum_needed = 5,000 × 10% = 500 → proposal now passes with only 500 votes

Increasing quorum to force a fail:

1. Proposal is 90% approved with high participation
2. Admin inflates total_supply to make the quorum unreachable, causing the proposal to fail

Impact

• Governance integrity is undermined — admin can unilaterally decide the outcome of any proposal by adjusting total_supply
• total_supply is particularly sensitive because it cannot be verified on-chain against the actual token's total supply (no oracle)

Fix

Snapshot total_supply at proposal creation and store it on the Proposal struct:

// In Proposal struct
pub total_supply_at_creation: i128,

// In finalize
let quorum_needed = proposal.total_supply_at_creation * config.quorum_bps as i128 / 10_000;

Severity: High

[Muhammadcodes112]

@Muhammadcodes112 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I have reviewed the description and I believe I can work on this if assigned
Thanks

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Muhammadcodes112 to this issue.

[Flamki]

@Flamki has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

i would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Flamki to this issue.

[prissca]

@prissca has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

i will love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @prissca to this issue.

[alfeedrips]

@alfeedrips has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Gm maintainer
I've looked at the amazing project you are building and it will be a joy to contribute to it. Kindly assign this task

ℹ️ Repo Maintainers: To accept this application, review their application or assign @alfeedrips to this issue.

[drips-wave]

Congratulations, @alfeedrips! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @alfeedrips: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @alfeedrips as part of the Stellar Wave Program's 7th Wave 🥳

😎 @alfeedrips: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.