# The system can get to a "stuck" state if a bad proposal (proposal that can't be executed) is accepted

LimboDAO allows only one active proposal; an accepted but unexecutable proposal blocks voting and execution, permanently jamming the DAO.

- Payout: Audit contest
- Severity: medium
- Program: Behodler
- Found by: CertoraInc
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-behodler-findings/issues/153
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-behodler%3AM-04
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:governance

**Target:** LimboDAO governance contract (makeProposal/executeCurrentProposal)
**Root cause:** The updateCurrentProposal modifier calls proposal.orchestrateExecute() directly; if execution reverts, the whole tx reverts and the proposal stays current in voting state, while makeProposal requires current proposal == address(0).
**Steps:**
1. Accept a proposal that cannot execute (e.g. `UpdateMultipleSoulConfigProposal` with too many tokens / insufficient gas).
2. Voting window passes; `vote()` reverts since voting ended.
3. Call `executeCurrentProposal()`; `orchestrateExecute()` reverts, reverting the whole tx and leaving proposal as current.
4. Call `makeProposal()`; reverts because current proposal != address(0).
5. DAO is stuck: no new proposals can be registered.
**How found:** Code review of LimboDAO's single-proposal invariant and the revert-on-failure execute path; noticed proposals that cannot succeed leave state inconsistent.
**Exploitation:** Not directly weaponized in the text; developer notes an attacker could pause Limbo via flash governance, then a jammed DAO cannot unpause, locking staked funds permanently.
**Escalation:** Chained with flash-governance pause: stuck DAO cannot pass unpause proposal, locking all staked funds.
**Insight:** When a contract enforces a single-slot state machine (one active proposal), check what happens if the terminal transition (execute) reverts — a revert that rolls back state can leave the slot permanently occupied.