Audit Fixes and Improvements

contracts/voting/dao-voting-native-staked/src/contract.rs

@@ -66,10 +66,18 @@ pub fn instantiate(
     CONFIG.save(deps.storage, &config)?;
     DAO.save(deps.storage, &info.sender)?;
 
+    // Validate denom by checking supply
+    let supply: Coin = deps.querier.query_supply(msg.denom.to_string())?;
+    println!("supply {:?}", supply);
+    if Uint128::is_zero(&supply.amount) {
+        return Err(ContractError::InvalidDenom {});
+    }
+
+    // Validate active threshold
     if let Some(active_threshold) = msg.active_threshold.as_ref() {
         match active_threshold {
             ActiveThreshold::AbsoluteCount { count } => {
-                assert_valid_absolute_count_threshold(deps.as_ref(), &msg.denom, *count)?;
+                assert_valid_absolute_count_threshold(*count, supply.amount)?;
             }
             ActiveThreshold::Percentage { percent } => {
                 if *percent > Decimal::percent(100) || *percent <= Decimal::percent(0) {
@@ -85,15 +93,13 @@ pub fn instantiate(
 }
 
 pub fn assert_valid_absolute_count_threshold(
-    deps: Deps,
-    token_denom: &str,
     count: Uint128,
+    supply: Uint128,
 ) -> Result<(), ContractError> {
     if count.is_zero() {
         return Err(ContractError::ZeroActiveCount {});
     }
-    let supply: Coin = deps.querier.query_supply(token_denom.to_string())?;
-    if count > supply.amount {
+    if count > supply {
         return Err(ContractError::InvalidAbsoluteCount {});
     }
     Ok(())
@@ -285,7 +291,8 @@ pub fn execute_update_active_threshold(
             }
             ActiveThreshold::AbsoluteCount { count } => {
                 let denom = CONFIG.load(deps.storage)?.denom;
-                assert_valid_absolute_count_threshold(deps.as_ref(), &denom, count)?;
+                let supply: Coin = deps.querier.query_supply(denom.to_string())?;
+                assert_valid_absolute_count_threshold(count, supply.amount)?;
             }
         }
         ACTIVE_THRESHOLD.save(deps.storage, &active_threshold)?;

contracts/voting/dao-voting-native-staked/src/error.rs

@@ -16,6 +16,9 @@ pub enum ContractError {
     #[error("Unauthorized")]
     Unauthorized {},
 
+    #[error("Denom does not exist on chain")]
+    InvalidDenom {},
+
     #[error("Invalid unstaking duration, unstaking duration cannot be 0")]
     InvalidUnstakingDuration {},
 

contracts/voting/dao-voting-native-staked/src/tests.rs

@@ -243,6 +243,25 @@ fn test_instantiate_invalid_unstaking_duration_height() {
     );
 }
 
+#[test]
+#[should_panic(expected = "Denom does not exist on chain")]
+fn test_instantiate_invalid_denom() {
+    let mut app = mock_app();
+    let staking_id = app.store_code(staking_contract());
+
+    // Populated fields with height
+    instantiate_staking(
+        &mut app,
+        staking_id,
+        InstantiateMsg {
+            // This denom has zero supply
+            denom: "uinvalid2".to_string(),
+            unstaking_duration: None,
+            active_threshold: None,
+        },
+    );
+}
+
 #[test]
 #[should_panic(expected = "Invalid unstaking duration, unstaking duration cannot be 0")]
 fn test_instantiate_invalid_unstaking_duration_time() {