# createProposal snapshot block can temporarily desync with minApproval / minVotingPower

Aragon Multisig createProposal snapshots voter eligibility one block back but applies current minApprovals, letting a just-lowered threshold combine with stale member set to pass proposals.

- Payout: Audit contest
- Severity: medium
- Program: Aragon Protocol
- Found by: 0x52
- Disclosed: 2023-12-12
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-03-aragon#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-aragon%3AM-03
- Tags: area:web3 domain:web3 impact:privesc kind:contest platform:code4rena sev:medium tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:governance

**Target:** Multisig.sol createProposal / voting plugins (multisig, token, addresslist)
**Root cause:** createProposal sets snapshotBlock = block.number - 1 for voter eligibility but reads current multisigSettings.minApprovals, so eligibility and threshold come from different blocks.
**Steps:**
1. Observe `uint64 snapshotBlock = block.number.toUint64() - 1;` in Multisig.sol#L214-L245.
2. Note proposal_.parameters.snapshotBlock uses that past block while proposal_.parameters.minApprovals = multisigSettings.minApprovals uses current settings.
3. Setup: 10-member multisig, minApprovals 6; 4 members compromised.
4. Pass a proposal removing the 4 members and lowering minApprovals to 4.
5. On the execution block, a malicious member creates a proposal removing the other six members; it snapshots eligibility from the prior block (still includes the 4 compromised accounts) but applies the new lower threshold.
6. The 4 compromised accounts approve and hijack the multisig.
**How found:** Code reading of createProposal revealed snapshotBlock is one block in the past while minApprovals is read live, prompting the desync hypothesis across multisig/token/addresslist voting.
**Exploitation:** Requires prior compromise of member keys plus a settings-changing proposal; the attacker times a new proposal to the execution block so stale eligibility (compromised members) meets the freshly lowered threshold, seizing control.
**Insight:** When a contract snapshots eligibility at block N-1, check every other parameter used for the same decision (thresholds, quorum, supply) is snapshotted identically; a one-block lag on one side is exploitable by timing a proposal to a settings-change block.