# Creating a new proposal in StandardGovernor may reach a state of permanent DoS Medium · Three Sigma · Stablecoin framework · 8th January, 2024 Finding 3S-M^0-L04 of the M^0 Minter Gateway security review. - Protocol: https://www.m0.org/ - Report: /reports/m-0 - Codebase: https://github.com/0xsimao/ttg/tree/a8127901fa1f24a2e821cf4d9854a1aa6ac8088c - Source: https://cdn.sanity.io/files/qoqld077/production/1cdafafad874aba76e062ad8c216c98338c096db.pdf --- ### Description The function [StandardGovernor.propose](https://github.com/MZero-Labs/ttg/blob/a8127901fa1f24a2e821cf4d9854a1aa6ac8088c/src/StandardGovernor.sol#L138-L162) is used to create a new proposal to be executed in the StandardGovernor. If it's the first proposal for that epoch, it will call [PowerToken.markNextVotingEpochAsActive](https://github.com/MZero-Labs/ttg/blob/a8127901fa1f24a2e821cf4d9854a1aa6ac8088c/src/PowerToken.sol#L125-L143) to set the next target supply. Inside this ```solidity function, there's a check to cap the next target supply at type(uint240).max: uint240 nextTargetSupply_ = _nextTargetSupply = UIntMath.bound240( uint256(_targetSupply) + (_targetSupply * ``` participationInflation) / ONE ); The issue is that the most likely scenario will be that the multiplication _targetSupply * participationInflation will overflow first, before any bound checks. Because _targetSupply is a uint240 and participationInflation is a uint16, the multiplication will raise a panic overflow when it passes the maximum value of a uint240. This means that, in most cases, the transaction will revert with a panic overflow instead of just capping the next target supply. Because the problematic function is called by StandardGovernor.propose for the first proposal of an epoch, this results in a permanent denial-of-service situation where it will no longer be possible to create new proposals in the StandardGovernor. ### Recommendation Cast _targetSupply to not allow a uint240 overflow: ```solidity uint240 nextTargetSupply_ = _nextTargetSupply = UIntMath.bound240( uint256(_targetSupply) + (uint256(_targetSupply) * ``` participationInflation) / ONE ); ### Status Addressed in [#c2131a5](https://github.com/MZero-Labs/ttg/commit/c2131a5fb1dc1d8f4eb12874165016b90885db2d).