# Governance arbitrary call takeover

Proposal or batch paths that execute arbitrary calls or mint voting power, letting a majority seize control

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-01-10. Updated 2026-10-25._

## How it works
Governance systems assume that a supermajority or a scheduled, vetted proposal is required for sensitive actions. That assumption breaks when a proposal path can execute arbitrary calls, or when a privileged action mints claim or voting tokens to a contract that a later step is supposed to distribute or check. A bare majority (or any proposer) can then chain calls to move assets or grant itself power before the intended safeguard runs.

## Where it shows up
- Arbitrary-call or batch proposal executors with a target/selector allowlist that omits sensitive contracts (authority, minter, timelock) [E1](https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-10-party%3AH-01.md)
- Minting of claim/voting tokens to a contract followed by a separate `distribute()` or snapshot step [E1](https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06.md)
- Batch execution that verifies scheduling or state *after* running the calls [E2](https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-02.md)
- Forked governance libraries with local overrides that drop a state check (e.g. Queued) [E2](https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-02.md)
- "Unanimous" bypasses for precious assets reachable after a majority mints voting power [E3](https://bugbountylibrary.com/r/c4%3A2023-10-party%3AH-01.md)

## How to review
Trace every path that can execute arbitrary calls or mint power. The invariant: no action reachable by less than the required threshold can move assets, mint voting power, or alter the executor's own permissions. Check that allowlists/blocklists cover all authority and minter contracts, that minted tokens are distributed atomically or locked until distribution, and that batch executors validate scheduling and state *before* execution. Diff inherited libraries against upstream advisories and confirm overrides don't widen preconditions [E2](https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-02.md).

## Variants seen
- Chain of FractionalizeProposal + ArbitraryCallsProposal to move minted ERC20 supply before distribute() [E1](https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06.md)
- Self-scheduling batch in a vulnerable TimelockController plus removed Queued check [E2](https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-02.md)
- ArbitraryCallsProposal reaching AddPartyCardsAuthority to mint a puppet with huge voting power, then passing a "unanimous" transfer [E3](https://bugbountylibrary.com/r/c4%3A2023-10-party%3AH-01.md)

## Impact and severity
Critical: theft of precious NFTs and treasury tokens, and seizure of DAO admin roles [E1](https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06.md)[E2](https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-02.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-10-party%3AH-01.md). Worse when safeguards (unanimity, distribution) are bypassable by a simple majority or any proposer, and when forked code carries known bugs.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-02.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-party%3AH-01.md