Mina Decentralized Treasury

Findings · 9

1. 1 Unpausing a proposal resets its status to UNKNOWN, discarding approval or rejection outcomes Informational
2. 2 Custom multisignature implementation baked into application code Informational
3. 3 Incomplete action state check allows a malicious prover to manipulate proposal outcomes High
4. 4 All-abstain voting permanently blocks proposal tally Low
5. 5 No minimum proposal amount allows bond-free proposal spam Low
6. 6 Signatures are not bound to a specific deployment, enabling cross-deployment replay Medium
7. 7 Multisignature circuit does not enforce participant key uniqueness Informational
8. 8 Unchecked actionStateHistoryTarget enables selective vote-tally exclusion High
9. 9 Incomplete error handling in deserialization methods Informational

Findings extracted from the published report PDF. See the full report below for details and remediation.