# Any fractions deposited into any proposal can be stolen at any time until it is commited

Migration.commit starts a buyout that sweeps all fractions held by the Migration contract, letting an attacker steal other users' deposited fractions for free.

- Payout: Contest reward
- Severity: high
- Program: Fractional
- Credited: panprog
- Disclosed: 2022-09-27
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/183
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Migration/Buyout Solidity modules
**Root cause:** Buyout.start takes all fractions owned by the proposer (the Migration contract) rather than only the fractions deposited for the specific proposal, so a competing proposal's commit sweeps other proposals' fractions into its buyout.
**Steps:**
1. Bob calls `migrationModule.propose(...)` then `join{value: 1 ether}(vault, 1, 3000)` depositing 3000 fractions.
2. Alice calls `propose(...)` with `targetPrice = 0` and `join{value: 1}(vault, 2, 0)` depositing 0 fractions.
3. Alice calls `commit(vault, 2)`; price > targetPrice so buyout starts, but Buyout.start pulls all 3000 fractions from Migration.
4. Alice calls `buyoutModule.buyFractions(vault, 3000)` paying 0 ether, receiving Bob's fractions.
**How found:** Code reading of Buyout.start (L73) and Migration.commit (L210) revealed buyout takes all fractions held by the Migration contract instead of the proposal-specific amount.
**Exploitation:** Attacker opens a competing migration proposal with targetPrice 0, joins with 0 fractions and 1 wei, commits to trigger buyout which sweeps all Migration-held fractions into the buyout, then buys them for free.
**Insight:** When a shared contract custodies per-user deposits, check whether downstream calls pull the contract's entire balance instead of the caller's tracked share; a zero-cost competing proposal can then sweep pooled funds.