execute in VoteProxy should be payable

[code423n4]

Handle

wuwe1

Vulnerability details

Impact

execute will revert when msg.value > 0

Proof of Concept

Lacking payable mutability specifier.

https://github.com/code-423n4/2022-02-concur/blob/main/contracts/VoteProxy.sol#L28-L35

    function execute(
        address _to,
        uint256 _value,
        bytes calldata _data
    ) external onlyOwner returns (bool, bytes memory) {
        (bool success, bytes memory result) = _to.call{value: _value}(_data);
        return (success, result);
    }

Recommended Mitigation Steps

Add payable mutability specifier.

[GalloDaSballo]

@leekt Can you tell me what you'd need execute to be used for?

Do you really need it to be payable?

[GalloDaSballo]

After some thinking I do believe that it would be wise to allow for payable calls

Will mark as valid and because this is contingent on a specific usage, I think Medium Severity to be appropriate