# Governance threshold and snapshot manipulation

Quorum, threshold, or vote snapshot read from a manipulable or mismatched source, letting one actor capture votes

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-05-23. Updated 2026-10-25._

## How it works
Governance decisions rely on a number: a quorum, a threshold, or a snapshot of voting power. The assumption that breaks is that this number is stable and measured in one consistent unit. When the number is derived from a running aggregate that other actions can move, or from a snapshot taken at a boundary the caller can choose, or from terms whose units differ, a single actor can arrange for the check to pass with less real support than intended — or block others from participating at all.

## Where it shows up
- Ratio or threshold checks against a running aggregate (cumulative totals) that withdrawals or unlocks can decrease.
- Snapshot helpers that special-case `block.number == startBlock` versus `block.number > startBlock`, giving different voting power at the boundary.
- Threshold formulas mixing units: a treasury-token amount compared against a non-treasury token slice, or absolute amounts where the spec states percentages.
- Entrypoints that permit voting exactly at the start block while sibling entrypoints require strictly later blocks.
- Any governance parameter that a deposit, lock, or unlock path can shift before the vote is read.

## How to review
Identify the exact quantity the quorum/threshold check reads and trace every path that can change it. The invariant: the value compared must be measured in the same unit as the requirement, and must not be movable by the same actor within the voting window. Check that all entrypoints use the same snapshot rule at the boundary (no equality special-case that one caller can exploit). Check that aggregate-based checks cannot be driven below their minimum by legitimate decrease paths. Compare the code formula against the written spec term by term, confirming units match.

## Variants seen
- Aggregate-ratio check where unlocks shrink the denominator, DoSing new locks and monopolizing governance [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-20.md).
- Snapshot boundary special-case letting a voter choose the block with higher voting power [E2](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-07.md).
- Threshold mixing treasury and non-treasury units, understating required quorum so a large holder drains the treasury across proposals [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-12.md).

## Impact and severity
Outcomes ranged from denial of service and governance monopolization [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-20.md), to inconsistent vote accounting at a boundary [E2](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-07.md), to treasury drain by a 71% holder [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-12.md). Severity rises when the manipulated quantity gates fund movement or when one actor can both trigger the shift and vote.

## Why fixes fail
Not shown in evidence.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-20.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-07.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-12.md