bareli - no access control on executeProposal

[sherlock-admin3]

bareli

Medium

no access control on executeProposal

Summary

There is no access control on executeProposal.

Vulnerability Detail

function executeProposal(uint256 proposalID) external {
(bool finished, bool passed, ) = proposalStatus(proposalID);
require(!finished, "voting has ended");
require(passed, "proposal has not been passed yet");

    _executeProposal(proposalID);
}

Impact

anyone can call this function to execute any proposalID

Code Snippet

https://github.com/sherlock-audit/2024-08-morphl2/blob/main/morph/contracts/contracts/l2/staking/Gov.sol#L190

Tool used

Manual Review

Recommendation

use onlyowner