# excuteProposal can fail due to Wormhole guardian change

TemporalGovernor re-verifies queued Wormhole VAAs at execution; a guardian set rotation between queue and execute invalidates the VAA, blocking proposal execution.

- Payout: Audit contest
- Severity: medium
- Program: Moonwell
- Found by: immeas
- Disclosed: 2023-10-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-07-moonwell#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-03
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:dos vuln:governance

**Target:** TemporalGovernor governance contract / Wormhole VAA verification
**Root cause:** _executeProposal re-runs wormholeBridge.parseAndVerifyVM on the stored VAA, which fails if the Wormhole guardian set index changed since queuing, since the VAA was signed by the now-expired set.
**Steps:**
1. Queue a proposal via _queueProposal(VAA); parseAndVerifyVM succeeds and message is stored by vm.hash.
2. Wormhole governance calls submitNewGuardianSet, expiring the old guardian set and updating the index.
3. After proposalDelay, call executeProposal(VAA); _executeProposal calls parseAndVerifyVM again.
4. Verification fails with 'guardian set has expired' because vm.guardianSetIndex != current index, so the proposal cannot execute.
**How found:** Noticed the VAA is verified twice (queue and execute) and cross-referenced Wormhole's Messages.sol guardian-set expiry check against Governance.sol's ability to rotate guardian sets, realizing state can change between the two checks.
**Insight:** When a contract verifies an external signed message at queue time and again at execute time, check whether the verifier's trust set (guardian/validator keys) can rotate in between; store the validated payload rather than re-verifying a signature whose signer set may expire.