A privileged submission skips validation, letting one member forge the deciding record
- Severity
- High
- Class
- Access control
- System
- On-chain stablecoin
A single council member can submit an unvalidated snapshot that forges the electorate and authorises draining the treasury.
A submission that fed a governance decision was accepted from a privileged member without validating its contents. That let one member hand in a forged record of who was entitled to decide, and the system acted on it as though it were legitimate.
Forge the electorate and you forge the outcome — including one that moves the treasury.
Why it rated High
A single insider can manufacture a governance result and reach the treasury, though it does require that privileged role rather than an anonymous attacker.
The fix class
Validate the submitted record against the real, independently derived state before any decision consumes it.

