# Logic error in burnFlashGovernanceAsset can cause locked assets to be stolen

burnFlashGovernanceAsset resets pendingFlashDecision to default instead of deleting it, letting a burned attacker withdraw another user's locked governance assets.

- Payout: Audit contest
- Severity: high
- Program: Behodler
- Found by: shw
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-behodler-findings/issues/305
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-behodler%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** FlashGovernanceArbiter governance asset locking contract
**Root cause:** burnFlashGovernanceAsset sets pendingFlashDecision[targetContract][user] to the default config rather than deleting it, so unlockTime becomes 0 and the withdraw unlock check passes immediately.
**Steps:**
1. Alice executes malicious flash governance decision; her assets lock in FlashGovernanceArbiter.
2. Community calls `burnFlashGovernanceAsset` on Alice; line 134 resets her pendingFlashDecision to default (unlockTime=0).
3. Bob executes a flash governance decision; his assets lock in the contract.
4. Alice calls `withdrawGovernanceAsset`; `unlockTime < block.timestamp` holds due to default config, withdrawing Bob's locked asset.
**How found:** Code review of burnFlashGovernanceAsset noticed it assigns default config instead of deleting the mapping entry, making the unlockTime check trivially satisfiable.
**Exploitation:** Attacker first locks assets via a malicious flash decision, gets burned (which resets their pendingFlashDecision to default), then waits for a victim to lock assets and calls withdrawGovernanceAsset to drain the victim's locked funds.
**Insight:** When a 'burn/penalty' path resets state, check whether it writes a default struct instead of deleting the key — a zeroed unlockTime can bypass time-lock checks on a shared pool of locked assets.