# You can flip governance decisions without extending vote duration

In Behodler's LimboDAO, a voter can zero out current fate then flip the vote in a second tx, bypassing the vote-duration extension logic.

- Payout: Audit contest
- Severity: medium
- Program: Behodler
- Found by: camden
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-behodler-findings/issues/106
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-behodler%3AM-12
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** LimboDAO governance voting contract (Solidity)
**Root cause:** Vote-flip detection uses `(fate + currentFate) * fate == 0` and `fate * currentFate == 0`, so a two-step vote (to zero, then to opposite sign) never satisfies the flip condition and never extends the voting period.
**Steps:**
1. Read LimboDAO.sol L281 flip-detection logic using fate*currentFate products.
2. Send a vote exactly equal to -currentFate so `(fate + currentFate) * fate == 0`; state not extended.
3. In a second tx send fate of opposite sign; now `fate * currentFate == 0` since currentFate is 0, so extension still not triggered.
4. Result: decision flipped at end of voting window without extending duration.
**How found:** Code review of the flip-detection arithmetic in LimboDAO.sol; noticed the product-based conditions treat a zero intermediate state as non-flip, enabling a two-transaction bypass.
**Exploitation:** Attacker waits until the end of the voting period, submits one tx to zero the current fate, then a second tx to push fate to the opposite side, flipping the outcome without triggering the duration-extension guard.
**Insight:** When a guard detects sign changes via multiplication, a zero intermediate value defeats it; check whether multi-step state transitions (to zero, then past zero) evade the same check.