# Adversary can prevent the creation of any extraordinary funding proposal by frontrunning proposeExtraordinary()

proposeExtraordinary omits endBlock_ from the proposal hash, letting an attacker frontrun with endBlock=0 to create a defeated proposal and block the real one.

- Payout: Contest reward
- Severity: medium
- Program: Ajna Protocol
- Credited: juancito
- Disclosed: 2023-06-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/260
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:governance

**Target:** ExtraordinaryFunding governance contract (proposeExtraordinary)
**Root cause:** proposalId hash excludes endBlock_, so two proposals with identical targets/values/calldatas/description but different endBlock collide; the first stored wins and the second reverts with ProposalAlreadyExists.
**Steps:**
1. Observe victim's proposeExtraordinary tx in mempool with targets/values/calldatas/description.
2. Frontrun calling `proposeExtraordinary(0, targets, values, calldatas, description)` with endBlock_=0.
3. Proposal stored with endBlock=0, state Defeated.
4. Victim's tx reverts with `ProposalAlreadyExists`.
5. Any voteExtraordinary reverts with `ExtraordinaryFundingProposalInactive` since endBlock < block.number.
**How found:** Code reading of proposeExtraordinary noticed endBlock_ is a parameter but not included in _hashProposal inputs, unlike other fields; hypothesized hash collision enables frontrun griefing and confirmed with a Foundry test.
**Exploitation:** Attacker watches mempool, copies the victim's proposal parameters, and submits the same call with endBlock_=0 at higher gas. The proposalId collides, the malicious proposal is stored as instantly expired/defeated, and the legitimate proposal can never be created; no votes possible, no execution.
**Insight:** When a proposal ID is a hash of user-supplied fields, check every parameter that affects lifecycle (start/end blocks, deadlines) is included; any omitted field lets an attacker mint a colliding ID with hostile timing to grief or DoS the legitimate submission.