# Extension voting threshold check needs to rerun on each transfer

Extension vote tally updates on transfer but threshold logic isn't rerun, so a qualifying extension vote can never be granted.

- Payout: Audit contest
- Severity: medium
- Program: Sublime
- Found by: cmichel
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-sublime-findings/issues/141
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AM-05
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity vuln:business-logic vuln:governance

**Target:** Extension voting contract (Solidity)
**Root cause:** removeVotes updates totalExtensionSupport on transfer but does not rerun the threshold-granting logic from voteOnExtension; the recipient already voted so cannot re-trigger it.
**Steps:**
1. `to` holds 100 tokens and calls `voteOnExtension` (sets `lastVotedExtension == _extensionVoteEndTime`).
2. `from` holds 100 tokens, never voted, transfers 100 tokens to `to`.
3. `removeVotes` runs, `totalExtensionSupport` rises to 200, crossing threshold.
4. `to` calls `voteOnExtension` again but reverts/fails because `lastVotedExtension == _extensionVoteEndTime`; extension never granted.
**How found:** Code reading of vote accounting: noticed votes are moved on transfer but the grant condition is only evaluated inside voteOnExtension, then constructed the transfer scenario where support crosses threshold without a fresh vote call.
**Insight:** When vote weight is mutable via token transfers, every balance-changing path (transfer/mint/burn) must re-evaluate the pass condition, not just the explicit vote function; check for state that gates re-voting.