# Governance Voting Dis-proportionally Favours Users Who Stake And Vote After A Poll Has Been Created And Had Its Snapshot Taken

Anchor governance snapshots total staked amount at poll creation but lacks per-user checkpoints, letting late stakers gain disproportionate voting power.

- Payout: Audit contest
- Severity: medium
- Program: Anchor
- Found by: BondiPestControl
- Disclosed: 2023-01-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-anchor-findings/issues/64
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-anchor%3AM-03
- Tags: domain:web3 kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** CosmWasm governance contract (gov/src/contract.rs, staking.rs)
**Root cause:** SnapshotPoll stores only the aggregate staked_amount at snapshot time; there are no per-user check-pointed balances, so votes use the voter's current staked balance rather than their balance at the snapshot block.
**Steps:**
1. Alice creates poll via `receive_cw20` with hook `Cw20HookMsg::CreatePoll` and calls `ExecuteMsg::SnapshotPoll`; `a_poll.staked_amount` = 100.
2. Bob stakes 10 ANC via `Cw20HookMsg::StakeVotingTokens`; contract balance and shares become 110 at 1:1 rate.
3. Poll still records `staked_amount == 100` while 110 tokens are staked.
4. Bob votes; his 10 shares are counted against the stale 100 denominator, giving ~10% influence instead of 10/110.
**How found:** Code reading of the snapshot and vote-tally logic: noticed SnapshotPoll only records aggregate staked_amount and that vote weight uses live balances with no historical checkpoint, then constructed a numeric example showing the denominator mismatch.
**Exploitation:** An attacker waits for a poll to be snapshotted, then stakes ANC before voting so their weight is computed against the smaller snapshotted total, amplifying their influence over the poll outcome.
**Insight:** When auditing governance/staking, check whether vote weight is measured against a historical checkpoint per user or against live balances; an aggregate-only snapshot creates a denominator mismatch exploitable by staking between snapshot and vote.