# Canceled proposals can still be executed

Cancelling a finalized Vader governance proposal only zeroes votes, leaving timestamps and finalising flags intact so the proposal can still be finalized and executed.

- Payout: Audit contest
- Severity: medium
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/228
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AM-06
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity vuln:business-logic vuln:governance

**Target:** Governance proposal lifecycle contract (cancelProposal/finaliseProposal)
**Root cause:** cancelProposal only zeroes mapPID_votes but leaves mapPID_timeStart and mapPID_finalising unchanged, so finaliseProposal's checks still pass and the proposal is queued for execution.
**Steps:**
1. Proposal passes threshold and is finalized.
2. A minority calls `cancelProposal`, which sets `mapPID_votes` to zero only.
3. `mapPID_timeStart` and `mapPID_finalising` remain unchanged.
4. `finaliseProposal` still passes its checks and queues the canceled proposal for execution.
**How found:** Code review of the cancel/finalise state machine: noticed cancelProposal only clears votes while finaliseProposal checks timestamps and finalising flags, leaving a gap.
**Exploitation:** A minority cancels a finalized proposal, but because the cancel state is not recorded, the proposal can still be finalized and executed, defeating the cancellation.
**Insight:** When auditing governance lifecycles, check that every state transition (cancel) is reflected in all fields the later transition (finalise/execute) validates; partial state resets leave canceled proposals executable.