# Guardian will not be able to cancel a malicious proposal

Bima's guardian cannot cancel any proposal containing a setGuardian action, so attackers bundle fund-draining actions with setGuardian to make malicious proposals uncancellable.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: 0xTheBlackPanther
- Disclosed: 2025-02-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** AdminVoting governance contract (proposal cancellation logic)
**Root cause:** _containsSetGuardianPayload() returns true if any action in a multi-action proposal calls setGuardian, and cancelProposal unconditionally reverts for such proposals, regardless of other bundled actions.
**Steps:**
1. Lock tokens to gain voting power via `tokenLocker.lock(user1, allocation, 52)`.
2. Build a 3-action payload: benign `setMinCreateProposalPct`, `bimaCore.setGuardian(user1)`, and `bimaVault.transferTokens(bimaToken, user1, amount)`.
3. Warp past `BOOTSTRAP_PERIOD()` and call `adminVoting.createNewProposal(user1, maliciousPayload)`.
4. Guardian calls `adminVoting.cancelProposal(proposalId)` which reverts with 'Guardian replacement not cancellable'.
5. Proposal remains active and executable once votes are gathered.
**How found:** Code review of _containsSetGuardianPayload() loop over all actions and cancelProposal's revert condition; noticed the check ignores payload length, so any multi-action proposal containing setGuardian becomes uncancellable.
**Exploitation:** Attacker with voting power creates a multi-action proposal embedding setGuardian alongside a vault drain; the guardian's cancelProposal reverts, leaving the malicious proposal live to execute and drain funds/set attacker as guardian.
**Escalation:** Bundling setGuardian with arbitrary malicious actions neutralizes the guardian's emergency cancellation, enabling fund drain and guardian takeover in one proposal.
**Insight:** When a safety check scans a list of batched actions and gates an emergency control (like cancellation), test whether an attacker can smuggle the protected action alongside harmful ones to disable the control entirely.