# Proposals can be cancelled

Anyone can cancel any DAO proposal by calling cancelProposal with identical old and new proposal IDs, bypassing the minority check and blocking governance execution.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/227
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-04
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** DAO governance contract (cancelProposal)
**Root cause:** cancelProposal(id, id) compares a proposal against itself; the minority check trivially passes because the proposal is already approved, so the cancellation path executes unconditionally.
**Steps:**
1. Call `DAO.cancelProposal(id, id)` with `oldProposalID == newProposalID` for any approved proposal id
2. Minority check passes since the proposal is approved
3. Proposal is cancelled, blocking execution
**How found:** Code review of the cancelProposal parameter validation; noticed oldProposalID and newProposalID are not required to differ, making the minority check self-satisfying.
**Exploitation:** Attacker calls cancelProposal with the same id for both arguments on any pending/approved proposal, cancelling it and denying execution of all governance proposals (governance DoS).
**Insight:** In governance contracts, check that paired proposal-ID parameters (old/new) are distinct before running comparison-based approval checks; self-comparison can satisfy quorum/minority logic.