# Missing check in the updateValset function

Gravity.sol updateValset omits checking that new validator power sum exceeds threshold, letting a valset be set that can never approve operations, locking all tokens.

- Payout: Audit contest
- Severity: medium
- Program: Cudos
- Found by: CertoraInc
- Disclosed: 2022-09-02
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-05-cudos#m-01
- Library page: http://bugbountylibrary.com/r/c4%3A2022-05-cudos%3AM-01
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:dos

**Target:** Gravity.sol updateValset validator set update
**Root cause:** updateValset accepts a new valset without verifying the sum of new validator powers exceeds state_powerThreshold, and without guarding against power-sum overflow.
**Steps:**
1. Current valset: 100 validators each power 10, threshold 900.
2. Call `updateValset` with 100 validators each power 1.
3. New total power (100) is below threshold (900); no signature quorum can ever be reached.
4. All operations including further valset updates are permanently blocked, locking tokens.
**How found:** Code review of updateValset's validation logic; noticed the missing comparison between summed new powers and state_powerThreshold, then constructed arithmetic examples for under-threshold and overflow cases.
**Exploitation:** A valset update carrying insufficient (or overflowing) total power is accepted; afterwards no combination of validator signatures reaches the threshold, so every Gravity operation including subsequent updateValset calls reverts, freezing all tokens on the chain.
**Insight:** When a contract trusts an off-chain module to normalize voting power, still verify on-chain that the incoming set's summed power clears the threshold and cannot overflow — otherwise a single bad update bricks the quorum permanently.