Attacker could abuse victim's vote to pass their own proposal
Proposals are created using submitProposal():\\n```\\n        function submitProposal(uint8 _actionType, bytes memory _payload)  public onlyCouncil {\\n             uint256 proposalId = proposalCount;\\n                 proposals[proposalId] = Proposal(msg.sender,_actionType, \\n                    _payload, 0, false);\\n                proposalCount += 1;\\n         emit ProposalSubmitted(proposalId, msg.sender);\\n        }\\n```\\n\\nAfter submission, council members approve them by calling confirmTransaction():\\n```\\n        function confirmTransaction(uint256 _proposalId) public onlyCouncil \\n            notConfirmed(_proposalId) {\\n             confirmations[_proposalId][msg.sender] = true;\\n             proposals[_proposalId].confirmation += 1;\\n        emit Confirmation(_proposalId, msg.sender);\\n        }\\n```\\n\\nNotably, the _proposalId passed to `confirmTransaction()` is simply the proposalCount at time of submission. This design allows the following scenario to occur:\\nUser A submits proposal P1\\nUser B is interested in the proposal and confirms it\\nAttacker submits proposal P2\\nA blockchain re-org occurs. Submission of P1 is dropped in place of P2.\\nUser B's confirmation is applied on top of the re-orged blockchain. Attacker gets their vote. We've seen very large re-orgs in top blockchains such as Polygon, so this threat remains a possibility to be aware of.
Calculate proposalId as a hash of the proposal properties. This way, votes cannot be misdirected.
```\\n        function submitProposal(uint8 _actionType, bytes memory _payload)  public onlyCouncil {\\n             uint256 proposalId = proposalCount;\\n                 proposals[proposalId] = Proposal(msg.sender,_actionType, \\n                    _payload, 0, false);\\n                proposalCount += 1;\\n         emit ProposalSubmitted(proposalId, msg.sender);\\n        }\\n```\\n