The fork mechanism of Nouns DAO may be completely ineffective or abused, because there is no reasonable limit to the maximum or minimum value of the fork threshold.
Audit: 2023-07-nounsdao-findings
Severity: HIGH

# Lines of code

https://github.com/nounsDAO/nouns-monorepo/blob/718211e063d511eeda1084710f6a682955e80dcb/packages/nouns-contracts/contracts/governance/NounsDAOV3Admin.sol#L551-L558
https://github.com/nounsDAO/nouns-monorepo/blob/718211e063d511eeda1084710f6a682955e80dcb/packages/nouns-contracts/contracts/governance/NounsDAOLogicV3.sol#L802-L804


# Vulnerability details

## Impact
Nouns Fork is a **Last-Resort Minority Protection Mechanism**, created to protect the minority from the tyranny of the majority. As described in this article: https://mirror.xyz/0x10072dfc23771101dC042fD0014f263316a6E400/iN0FKOn_oYVBzlJkwPwK2mhzaeL8K2-W80u82F7fHj8.

In the initial case, if a quorum of 20% of tokens signals to exit, the fork will succeed, but since the system has no reasonable limit to the maximum or minimum value of the fork threshold, the majority can initiate a new proposal to improve the fork Threshold value, for example: 90% or even 100%.

As a result, those who support the fork can never reach the fork threshold. In this case, the fork of DAO will never happen, and the design mechanism to protect the minority from the tyranny of the majority cannot be achieved.

## Proof of Concept

1. In NounsDAOV3Admin.sol, there is the following code:
https://github.com/nounsDAO/nouns-monorepo/blob/718211e063d511eeda1084710f6a682955e80dcb/packages/nouns-contracts/contracts/governance/NounsDAOV3Admin.sol#L551-L558

```solidity    
function _setForkThresholdBPS(NounsDAOStorageV3.StorageV3 storage ds, uint256 newForkThresholdBPS)
        external
        onlyAdmin(ds)
    {
        emit ForkThresholdSet(ds.forkThresholdBPS, newForkThresholdBPS);

        ds.forkThresholdBPS = newForkThresholdBPS;
    }
```

Among them, `ds.forkThresholdBPS` is the core parameter for calculating whether DAO has reached the fork threshold, and the calculation code for the fork threshold is: `(adjustedTotalSupply(ds) * ds.forkThresholdBPS) / 10_000;`, if the value of `ds.forkThresholdBPS` The value is set to 10000 or higher, which can raise the fork threshold to an unreachable height.

2. A majority in the DAO can initiate a proposal to change `ds.forkThresholdBPS` to 10000 or higher. Because the majority firmly holds the right to cast the majority of votes, even if a few people object, the proposal will still be easily passed and implemented according to the normal process.

Proposal initiation parameter reference:

```solidity
uint8 numTxs = 10;
address[] memory targets = new address[](numTxs);
uint256[] memory values = new uint256[](numTxs);
string[] memory signatures = new string[](numTxs);
bytes[] memory calldatas = new bytes[](numTxs);

uint256 i = 0;
targets[i] = address(daoProxy);
values[i] = 0;
signatures[i] = '_setForkThresholdBPS(uint256 newForkThresholdBPS)';
calldatas[i] = abi.encode(10000);
uint256 proposalId = daoProxy.propose(targets, values, signatures, calldatas, description);
```

## Tools Used
Visual Studio Code
Foundry 

## Recommended Mitigation Steps

Add two co