# ERC20ConvictionScore._updateConvictionScore uses stale credit score for governanceDelta

Same-block conviction score update then balance transfer leaves stale governanceDelta, inflating TOTAL_GOVERNANCE_SCORE and potentially breaking quorum.

- Payout: Audit contest
- Severity: high
- Program: FairSide
- Disclosed: 2021-07-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-05-fairside-findings/issues/41
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-fairside%3AH-07
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:governance

**Target:** ERC20ConvictionScore governance accounting contract
**Root cause:** When a user drops below governanceMinimumBalance, governanceDelta is taken from getPriorConvictionScore(user, block.number-1) instead of the current checkpoint, and same-block transactions skip the time-elapsed logic path so newly accrued conviction is never properly accounted for.
**Steps:**
1. User is governor with credit score 1000 contributing to TOTAL_GOVERNANCE_SCORE.
2. In block n, user calls public `updateConvictionScore`, adding 5000 accrued credit; total governance contribution now 6000.
3. In same block, user transfers whole balance away, dropping below `governanceMinimumBalance`.
4. `isGovernance[user]=false` and `governanceDelta = getPriorConvictionScore(user, block.number - 1)` returns only 1000, so TOTAL_GOVERNANCE_SCORE is reduced by 1000 instead of 6000.
**How found:** Reading _updateConvictionScore, noticed governanceDelta uses a prior-block snapshot; reasoned that same-block update plus balance drop would desync the total governance score from actual contributions.
**Exploitation:** Attacker repeatedly inflates their governance conviction contribution via same-block update-then-transfer, leaving residual inflated TOTAL_GOVERNANCE_SCORE so quorum (percentage of totalVotes) becomes unreachable, breaking governance.
**Escalation:** Repeated inflation across blocks dilutes all users and can permanently block proposals from reaching quorum.
**Insight:** In checkpoint-based governance accounting, test same-block sequences where accrual and eligibility-loss happen in one block — time-elapsed guards often skip the accounting path entirely, leaving totals desynced from per-user state.