This post briefly summarizes the Eco Governance Proposal submitted on Jan 12, 2023. This proposal patches a bug in Random Inflation and adds more robust checks around claiming proposal fees when submitting Random Inflation.
The vulnerability patched is in the InflationRootHashProposal.sol contract that oversees the process of submitting the Merkle tree for distributing rewards for Random inflation. A submission on Immunefi alerted us to an issue in the checkRootHashStatus method, which is intended to be used to mark a root hash proposal as being accepted after the challenge period has ended. The bug indicated that the status of an address’ root hash proposal could be locked in before the proposal was submitted. This would cause any challenges to this malicious Merkle tree to revert. The submission of a malicious root hash after this status check would jeopardize the integrity of the random inflation process, and subvert the checks put in place to make it equitable. The fix we implemented demands that the input address to checkRootHashStatus has properly submitted a root hash proposal, and causes other calls to the method to fail. We also reinforced similar checks on other methods, such as claimFee.