# Improper access control of claimAllForMember allows anyone to reduce the weight of a member

Permissionless claimAllForMember lets anyone claim another member's unlocked bonded LP, lowering their BondVault weight and blocking their vote or harvest.

- Payout: Audit contest
- Severity: medium
- Program: Spartan Protocol
- Found by: shw
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/235
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AM-03
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Dao contract claimAllForMember function
**Root cause:** claimAllForMember takes an arbitrary member parameter and is callable by anyone; claiming a member's unlocked bonded LP reduces their BondVault weight, which feeds vote weight and reward calculations.
**Steps:**
1. Victim has BondVault weight 201 of total 300 and claimable LP tokens; claiming would drop weight to 101.
2. Victim calls `voteProposal` to finalize a proposal needing >66.6% majority (201/300).
3. Attacker front-runs with `claimAllForMember(victim)` to claim the victim's unlocked bonded LP.
4. Victim's weight becomes 101 of total 200 (101/200 < 66.6%), proposal cannot finalize.
5. Same front-run before `harvest` reduces victim's reward since reward is based on current weight.
**How found:** Code review of Dao access control: noticed claimAllForMember accepts an arbitrary member parameter and is permissionless, then reasoned about how weight changes affect vote finalization and reward math.
**Exploitation:** Attacker front-runs a victim's voteProposal or harvest transaction by calling the permissionless claimAllForMember with the victim's address, forcing a claim of the victim's unlocked bonded LP and reducing their weight at the critical moment.
**Insight:** When a permissionless function mutates another user's staked/weight state, check whether that state feeds governance thresholds or reward math and can be griefed by front-running the victim's action.