# ERC20ConvictionScore allows transfers to special TOTAL_GOVERNANCE_SCORE address

ERC20ConvictionScore lets anyone transfer FSD to the special TOTAL_GOVERNANCE_SCORE address, inflating totalVotes and stalling DAO governance quorum.

- Payout: Audit contest
- Severity: medium
- Program: FairSide
- Disclosed: 2021-07-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-fairside-findings/issues/42
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-fairside%3AM-08
- Tags: area:web3 domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:governance

**Target:** ERC20ConvictionScore / FairSideDAO governance contracts
**Root cause:** The special address(type(uint160).max) is used as an accumulator for all governors' credit scores, but transfers to it are not blocked, so any user can write checkpoints and inflate its conviction score.
**Steps:**
1. Transfer FSD directly to `address(type(uint160).max)`; `_updateConvictionScore` writes a checkpoint for TOTAL_GOVERNANCE_SCORE.
2. Call `updateConvictionScore(uint160.max)` to refresh the accumulated score based on the inflated balance.
3. The inflated score raises `FairSideDAO.totalVotes`, increasing the `quorumVotes` threshold so no proposal can reach quorum.
**How found:** Noticed the special TOTAL_GOVERNANCE_SCORE address is treated as a normal balance-holding user in `_updateConvictionScore`, and that nothing prevents direct transfers to it.
**Exploitation:** A non-governor below the voting threshold sends FSD to the special address and triggers a conviction score update, permanently diluting voting power and stalling proposals at the cost of losing the transferred FSD.
**Insight:** When a sentinel address is used as an accumulator for aggregate state, check whether ordinary token transfers or score-update paths can write to it; a separate variable avoids the attack surface entirely.