# activateProposal() need time delay

Olympus Governance activateProposal() has no activation delay and vote() omits proposalId, so a proposal can be swapped mid-vote, letting mempool front-runners redirect votes.

- Payout: Contest reward
- Severity: medium
- Program: Olympus DAO
- Disclosed: 2022-10-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/273
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AM-09
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:race-window technique:source-review vuln:governance vuln:race-condition

**Target:** Governance.sol activateProposal()/vote() on-chain governance contract
**Root cause:** activateProposal() replaces activeProposal immediately with no time lock, and vote() reads activeProposal.proposalId implicitly rather than taking a proposalId argument, so the voted-on proposal can change between intent and execution.
**Steps:**
1. Submit proposal and gather endorsements above ENDORSEMENT_THRESHOLD.
2. Wait until activeProposal.activationTimestamp + GRACE_PERIOD passes.
3. Call `activateProposal(proposalId_)` as submitter; activeProposal switches instantly.
4. Observe pending `vote(bool)` tx in mempool targeting old activeProposal.
5. Front-run with `activateProposal(newId)` so the pending vote lands on the new proposal.
**How found:** Code review of Governance.sol: noticed activateProposal() lacks a timelock and vote() does not accept a proposalId, only reading activeProposal, implying votes can be redirected if activation and voting race.
**Exploitation:** Attacker watches mempool for a large pending vote() call, front-runs with activateProposal() to swap activeProposal, causing the victim's vote to be counted for/against a different proposal, influencing two proposals' outcomes.
**Insight:** In on-chain governance, check whether vote functions bind to an explicit proposalId; implicit 'current proposal' reads plus instant activation create mempool front-run windows that silently misattribute votes.