Security fixes

[roisindowling]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
vevote-frontend-dev	Ready	Preview	Comment	Oct 23, 2025 3:41pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	turbo@​1.13.4 ⏵ 2.5.8	+2		+21	+1	+31
	axios@​1.8.4 ⏵ 1.12.2	+1	+22

View full report

[github-actions]

Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

• divide-before-multiply (1 results) (Medium)
• uninitialized-local (1 results) (Medium)
• unused-return (7 results) (Medium)

divide-before-multiply

Impact: Medium
Confidence: Medium

• ID-0
  VeVoteQuorumLogic._quorum(VeVoteStorageTypes.VeVoteStorage,uint48) performs a multiplication on the result of a division:
  • totalPotentialWeight = totalScaledWeight / minStake
  • (totalPotentialWeight * quorumNumerator(self,timepoint)) / quorumDenominator()

vevote/packages/contracts/contracts/governance/libraries/VeVoteQuorumLogic.sol

Lines 149 to 177 in 508a3af

	function _quorum(VeVoteStorageTypes.VeVoteStorage storage self, uint48 timepoint) internal view returns (uint256) {
	uint208[] memory circulatingSupplies = self.stargateNFT.getLevelsCirculatingSuppliesAtBlock(timepoint);
	DataTypes.Level[] memory stargateLevels = self.stargateNFT.getLevels();
	// Determine total potenial vote weigth from validators
	uint256 validatorStake = VeVoteConstants.VALIDATOR_STAKED_VET_REQUIREMENT;
	uint256 validatorWeight = self.levelIdMultiplier[0];
	uint256 totalScaledWeight = VeVoteConstants.TOTAL_AUTHORITY_MASTER_NODES * validatorStake * validatorWeight;
	// Cache number of levels
	uint256 levelCount = circulatingSupplies.length;
	for (uint8 i; i < levelCount; i++) {
	uint256 supply = circulatingSupplies[i];
	uint256 multiplier = self.levelIdMultiplier[i + 1]; // +1 to skip validator
	uint256 requiredStake = stargateLevels[i].vetAmountRequiredToStake;
	// supply * multiplier * requiredStake
	totalScaledWeight += supply * multiplier * requiredStake;
	}
	// Ensure minimum staked vet to hold stargate NFT is greater than 0
	uint256 minStake = VeVoteConfigurator.getMinStakedAmountAtTimepoint(self, timepoint);
	// Divide by minimum stake to own stargate NFT to determine total potenial weight
	uint256 totalPotentialWeight = totalScaledWeight / minStake;
	// return quorom
	return (totalPotentialWeight * quorumNumerator(self, timepoint)) / quorumDenominator();
	}

uninitialized-local

Impact: Medium
Confidence: Medium

• ID-1
  VeVoteProposalLogic.propose(VeVoteStorageTypes.VeVoteStorage,string,uint48,uint48).proposal is a local variable never initialized

vevote/packages/contracts/contracts/governance/libraries/VeVoteProposalLogic.sol

Line 105 in 508a3af

VeVoteTypes.ProposalCore memory proposal;

unused-return

Impact: Medium
Confidence: Medium

• ID-2
  VeVote.getProposalVotes(uint256) ignores return value by VeVoteVoteLogic.proposalVotes($,proposalId)

vevote/packages/contracts/contracts/VeVote.sol

Lines 163 to 168 in 508a3af

	function getProposalVotes(
	uint256 proposalId
	) external view returns (uint256 againstVotes, uint256 forVotes, uint256 abstainVotes) {
	VeVoteStorageTypes.VeVoteStorage storage $ = getVeVoteStorage();
	return VeVoteVoteLogic.proposalVotes($, proposalId);
	}

• ID-3
  VeVoteQuorumLogic.updateQuorumNumerator(VeVoteStorageTypes.VeVoteStorage,uint256) ignores return value by self.quorumNumeratorHistory.push(VeVoteClockLogic.clock(),SafeCast.toUint208(newQuorumNumerator))

vevote/packages/contracts/contracts/governance/libraries/VeVoteQuorumLogic.sol

Lines 113 to 124 in 508a3af

	function updateQuorumNumerator(VeVoteStorageTypes.VeVoteStorage storage self, uint256 newQuorumNumerator) external {
	uint256 denominator = quorumDenominator();
	uint256 oldQuorumNumerator = quorumNumerator(self);
	if (newQuorumNumerator > denominator) {
	revert VeVoteInvalidQuorumFraction(newQuorumNumerator, denominator);
	}
	self.quorumNumeratorHistory.push(VeVoteClockLogic.clock(), SafeCast.toUint208(newQuorumNumerator));
	emit QuorumNumeratorUpdated(oldQuorumNumerator, newQuorumNumerator);
	}

• ID-4
  VeVoteVoteLogic._determineValidatorVoteWeight(VeVoteStorageTypes.VeVoteStorage,address,address) ignores return value by (isListed,endorser,None,isActive) = validatorContract.get(masterAddress)

vevote/packages/contracts/contracts/governance/libraries/VeVoteVoteLogic.sol

Lines 407 to 428 in 508a3af

	function _determineValidatorVoteWeight(
	VeVoteStorageTypes.VeVoteStorage storage self,
	address voter,
	address masterAddress
	) private view returns (uint256 voteWeight) {
	// Load validator authority contract
	IAuthority validatorContract = VeVoteConfigurator.getValidatorContract(self);
	// Fetch validator info
	(bool isListed, address endorser, , bool isActive) = validatorContract.get(masterAddress);
	// Check eligibility
	if (!isListed || !isActive || endorser != voter) {
	return 0;
	}
	// Apply level 0 multiplier
	uint256 multiplier = self.levelIdMultiplier[0];
	// Compute vote weight
	voteWeight = VeVoteConstants.VALIDATOR_STAKED_VET_REQUIREMENT * multiplier;
	}

• ID-5
  VeVoteConfigurator.setMinStakedVetAmount(VeVoteStorageTypes.VeVoteStorage,uint256) ignores return value by self.minStakedVetHistory.push(VeVoteClockLogic.clock(),SafeCast.toUint208(newMinStake))

vevote/packages/contracts/contracts/governance/libraries/VeVoteConfigurator.sol

Lines 168 to 175 in 508a3af

	function setMinStakedVetAmount(VeVoteStorageTypes.VeVoteStorage storage self, uint256 newMinStake) external {
	if (newMinStake == 0) revert InvalidMinimumStake();
	uint256 previous = self.minStakedVetHistory.latest();
	self.minStakedVetHistory.push(VeVoteClockLogic.clock(), SafeCast.toUint208(newMinStake));
	emit MinStakedAmountUpdated(previous, newMinStake);
	}

• ID-6
  VeVoteStorage.__VeVoteStorage_init_unchained(VeVoteTypes.InitializationData) ignores return value by $.minStakedVetHistory.push(VeVoteClockLogic.clock(),SafeCast.toUint208(initializationData.initialMinStakedAmount))

vevote/packages/contracts/contracts/governance/VeVoteStorage.sol

Lines 43 to 78 in 508a3af

	function __VeVoteStorage_init_unchained(
	VeVoteTypes.InitializationData memory initializationData
	) internal onlyInitializing {
	VeVoteStorageTypes.VeVoteStorage storage $ = getVeVoteStorage();
	// Validate and set the governor external contracts storage
	require(address(initializationData.nodeManagement) != address(0), "VeVote: NodeManagement address cannot be zero");
	require(address(initializationData.stargateNFT) != address(0), "VeVote: StargateNFT address cannot be zero");
	require(address(initializationData.authorityContract) != address(0), "VeVote: Authority address cannot be zero");
	$.nodeManagement = initializationData.nodeManagement;
	$.stargateNFT = initializationData.stargateNFT;
	$.validatorContract = initializationData.authorityContract;
	// Set the general storage parameters
	$.minVotingDelay = initializationData.initialMinVotingDelay;
	$.minVotingDuration = initializationData.initialMinVotingDuration;
	$.maxVotingDuration = initializationData.initialMaxVotingDuration;
	// Initialize vote normalization base (min stake)
	require(initializationData.initialMinStakedAmount > 0, "VeVote: min stake must be > 0");
	$.minStakedVetHistory.push(VeVoteClockLogic.clock(), SafeCast.toUint208(initializationData.initialMinStakedAmount));
	// LevelId 0 is unused in Stargate, we will take advantage of this to represent Validator multiplier in VeVote. (Scaled by 100).
	$.levelIdMultiplier[0] = 200; // Validator multipler
	// Set the voting weight multipliers for different Stargate NFT level IDs. (Scaled by 100).
	$.levelIdMultiplier[1] = 100; // Strength Node multipler
	$.levelIdMultiplier[2] = 100; // Thunder Node multipler
	$.levelIdMultiplier[3] = 100; // Mjolnir Node multipler
	$.levelIdMultiplier[4] = 150; // VeThor X Node multipler
	$.levelIdMultiplier[5] = 150; // Strength X Node multipler
	$.levelIdMultiplier[6] = 150; // Thunder X Node multipler
	$.levelIdMultiplier[7] = 150; // Mjolnir X Node multipler
	$.levelIdMultiplier[8] = 100; // Dawn Node multipler
	$.levelIdMultiplier[9] = 100; // Lightning Node multipler
	$.levelIdMultiplier[10] = 100; // Flash Node multipler
	}

• ID-7
  VeVoteProposalLogic.execute(VeVoteStorageTypes.VeVoteStorage,uint256,string) ignores return value by VeVoteStateLogic.validateStateBitmap(self,proposalId,VeVoteStateLogic.encodeStateBitmap(VeVoteTypes.ProposalState.Succeeded))

vevote/packages/contracts/contracts/governance/libraries/VeVoteProposalLogic.sol

Lines 169 to 187 in 508a3af

	function execute(
	VeVoteStorageTypes.VeVoteStorage storage self,
	uint256 proposalId,
	string memory comment
	) external returns (uint256) {
	// Validate that proposal is in a succeeded state
	VeVoteStateLogic.validateStateBitmap(
	self,
	proposalId,
	VeVoteStateLogic.encodeStateBitmap(VeVoteTypes.ProposalState.Succeeded)
	);
	// Mark the proposal as executed
	self.proposals[proposalId].executed = true;
	emit VeVoteProposalExecuted(proposalId, comment);
	return proposalId;
	}

• ID-8
  VeVoteQuorumLogic._optimisticUpperLookupRecent(Checkpoints.Trace208,uint48) ignores return value by (None,key,value) = ckpts.latestCheckpoint()

vevote/packages/contracts/contracts/governance/libraries/VeVoteQuorumLogic.sol

Lines 183 to 191 in 508a3af

	function _optimisticUpperLookupRecent(
	Checkpoints.Trace208 storage ckpts,
	uint48 timepoint
	) private view returns (uint256) {
	// If trace is empty, key and value are both equal to 0.
	// In that case `key <= timepoint` is true, and it is ok to return 0.
	(, uint48 key, uint208 value) = ckpts.latestCheckpoint();
	return key <= timepoint ? value : ckpts.upperLookupRecent(timepoint);
	}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud