TBD

Nouns is a generative NFT project on Ethereum, where a new Noun is minted and auctioned off every day, all proceeds go to the DAO treasury, and each token represents one vote. To date more than 350 Nouns have been sold on auction, and the DAO has funded a variety of cool builders, including a recent 500 ETH grant to theprotocolguild.eth.

More intro information can be found on Nouns Center.

yarn

yarn test

forge install
forge test -vvv --ffi

The focus of this audit is on:

• The NounsDAOLogicV2 contract, which introduces two new features:
  • Dynamic quorum (spec)
  • Voting gas refund (spec)
  • A fix to how votingDelay is used (bug report)
• Parent contracts which hold state variables: NounsDAOStorageV2, NounsDAOStorageV1Adjusted, NounsDAOProxyStorage
• The upgrade process from v1 to v2
  • The upgrade will take place via a proposal; the proposal will include the following transactions:
    • call _setImplementation on the DAO proxy with the address of the V2 logic contract
    • call _setDynamicQuorumParams on the DAO proxy to set up dynamic quorum with parameters the DAO decided on
  • Proposals that were created on V1 and will remain active post-upgrade, should behave the same (e.g. maintain their quorum setting)
  • More generally, should ensure that there are no hidden storage issues when migrating from V1 → V2

Key risks we’d like you to explore:

• Bricking the DAO: this upgrade should not result in a non-functional DAO that cannot execute any additional proposals.
• Security: this upgrade should not introduce any new cost-effective attack vectors.

• A basic understanding of Compound’s Governor Bravo is very useful, since Nouns DAO V1 is an NFT-adapted fork of it
• Read NounsDAOLogicV1, since V2 is a diff from that; most importantly read the docs articulating the modifications from Compound’s contract
• Get acquainted with NounsToken, and specifically the ERC721Checkpointable features
• For full context on how Nouns works (beyond the in-scope contracts), read the Nouns Protocol wiki that covers the auction house and on-chain art contracts
• Nice-to-have: read Dialectic’s two great posts on a Nouns governance attack on the treasury: 1, 2

At this point you should have sufficient context to dive into V2:

• Read the docs on V2’s modifications
• Read the diff between NounsDAOLogicV2 and NounsDAOLogicV1
• Read the e2e test that demos the upgrade to V2