# Adversary can prevent updating price feed addresses by creating poisonous proposals ending in _confirm

Attacker creates a proposal named `setContract:priceFeed1_confirm`, blocking legit price-feed update proposals via the secondary-confirmation check, causing DAO DoS.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: juancito
- Disclosed: 2024-04-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/620
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:governance

**Target:** DAO Proposals contract (proposeSetContractAddress / proposeWebsiteUpdate)
**Root cause:** The `_confirm` suffix is used both to name confirmation ballots and to block new proposals, so an attacker can register a ballot whose name equals a future confirmation name, permanently occupying that namespace.
**Steps:**
1. Stake SALT as attacker (alice).
2. Call `proposals.proposeSetContractAddress("priceFeed1_confirm", newAddress, "description")` to create a ballot named `setContract:priceFeed1_confirm`.
3. Legit user (bob) stakes SALT and calls `proposals.proposeSetContractAddress("priceFeed1", newAddress, "description")`.
4. Call reverts with `Cannot create a proposal for a ballot with a secondary confirmation` because `openBallotsByName["setContract:priceFeed1_confirm"] != 0`.
5. Repeat every voting period to sustain the DoS.
**How found:** Reading `_possiblyCreateProposal`'s check `openBallotsByName[ballotName + "_confirm"] == 0` and noticing the confirmation ballot name is derived from user-controlled `contractName`, so a user can pre-register the confirmation name.
**Exploitation:** Attacker stakes SALT and submits a proposal whose contractName is `priceFeed1_confirm`, occupying the confirmation ballot name. Any subsequent legit `priceFeed1` proposal reverts at the `_possiblyCreateProposal` check, blocking price feed / accessManager / website updates until the attacker's ballot closes; attacker re-creates it each cycle.
**Insight:** When a protocol derives a reserved identifier (like a `_confirm` suffix) from user input and also uses that identifier as a uniqueness guard, check whether an attacker can pre-register the reserved name to block the legitimate flow.