# ERC20ConvictionScore's governanceDelta should be subtracted when user is not a governor anymore

ERC20ConvictionScore adds a positive governanceDelta when removing a governor, corrupting TOTAL_GOVERNANCE_SCORE and breaking DAO totalVotes/quorum.

- Payout: Audit contest
- Severity: high
- Program: FairSide
- Disclosed: 2021-07-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-fairside-findings/issues/40
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-fairside%3AH-04
- Tags: area:web3 domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** ERC20ConvictionScore / FairSideDAO voting contract
**Root cause:** In _updateConvictionScore, when a user is removed from governance, governanceDelta is set to the positive prior conviction score instead of a negative value, so it is added rather than subtracted from TOTAL_GOVERNANCE_SCORE.
**Steps:**
1. User stops meeting governance criteria in _updateConvictionScore; isGovernance[user] = false.
2. Code sets `governanceDelta = getPriorConvictionScore(user, block.number - 1)` (positive).
3. `totalGCSNew = add224(totalGCSOld, governanceDelta, ...)` adds instead of subtracting.
4. TOTAL_GOVERNANCE_SCORE inflates; FairSideDAO.totalVotes derived from it is wrong.
**How found:** Code review of _updateConvictionScore noticed the removal branch assigns a positive delta while the total is computed by addition, contradicting the intended subtraction.
**Exploitation:** Anyone can repeatedly trigger governor removal to inflate totalVotes, either passing proposals or pushing quorum out of reach so no proposal passes.
**Escalation:** Corrupted totalVotes propagates to FairSideDAO.totalVotes, enabling proposal passage or DoS of governance quorum.
**Insight:** When a total is maintained by signed deltas, audit every branch that flips a membership flag: removal paths must negate the delta, and add224-style unsigned helpers hide sign errors.