Part Three

Previously, the governance contract very kindly returned the governance tokens (or at least allowed withdrawals) for the amount used the vote. To avoid flash loan hazards, the team decided to lock deposited funds after proposals are executed. That way, if a user obtained governance tokens through a flash loan, they would not be able to repay the debt.

This mitigation seems less than ideal, since no more proposals can be passed once half the tokens are burned. But it should at least fix the problem, right?

GovernanceFixed.sol is the same as Governance.sol except for the addition of two lines in withdraw(id):

    function withdraw(uint256 id) public {
        require(id < proposals.length, "invalid proposal id");
        // fix the exploit! we just won't give tokens back
        require(!proposals[id].executed, "proposal already executed");

The other contracts are the same as part 2.

As always, your goal is to take control of the governance contract!