Edge case for the first proposal

[0xpessimist]

Summary

There is an edge case for the 0th (first) proposal for users who may want to fork and use AaveGovernanceV2.

When a project forks (deploys) and starts using AaveGovernanceV2, its first proposalId will be 0. The issue is that before any proposal is actually proposed, anyone can cancel the 0th proposal because it passes all necessary validating checks.

The following check prevents this situation for every proposal except the first proposal (0 = 0 so it passes but _proposalsCount = 0 means no proposal has been created yet):

governance-v2/contracts/governance/AaveGovernanceV2.sol

Line 412 in d4e5ae0

require(_proposalsCount >= proposalId, 'INVALID_PROPOSAL_ID');

As a result, even if the 0th proposal is proposed later, it will remain marked as canceled.

Impact

This issue has no impact, and if it occurs, it can be completely bypassed by proposing an empty first proposal. At most, some projects might not notice it until they attempt to execute the proposal, which could lead to wasted time. It can also confuse developers by making them think they initialized governance incorrectly.

Recommendation

There are several ways to fix this, the most obvious being to disallow cancel() if _proposalsCount == 0.