# Tolerance is not enforced during a flash governance decision

governanceApproved modifier enables tolerance enforcement only after the function body runs, letting a flash governance decision set arbitrary parameters like soul fps to inflate Flan rewards.

- Payout: Audit contest
- Severity: medium
- Program: Behodler
- Found by: shw
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-behodler-findings/issues/306
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-behodler%3AM-08
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Solidity governance modifier / Limbo soul reward parameters
**Root cause:** The governanceApproved modifier calls flashGoverner.setEnforcement(true) after executing the function body, so enforceTolerance never restricts parameter changes during the call.
**Steps:**
1. Call a governanceApproved function such as Limbo.adjustSoul via a flash governance decision.
2. Set the soul's fps to an extremely large value; enforcement is only enabled after the body executes, so no tolerance check applies.
3. Stake tokens on the soul beforehand, then call claimReward to receive inflated Flan rewards based on the manipulated fps.
4. Accept loss of locked EYE collateral in FlashGovernanceArbiter if Flan gained exceeds it.
**How found:** Code reading of the governanceApproved modifier ordering: noticed setEnforcement(true) runs after the function body, so tolerance is not active during execution.
**Exploitation:** Attacker uses a flash governance decision to set fps arbitrarily high, then claims rewards on a pre-staked soul to mint excess Flan, sacrificing locked EYE only if reward value exceeds it.
**Insight:** When a modifier is meant to constrain a function's parameters, check whether the guard is applied before the body (precondition) versus after (postcondition) — post-body enforcement leaves the entire call unconstrained.