# Proposal which started buyout which fails is able to settle migration as if its buyout succeeded.

A failed migration proposal stays committed and can call settleVault after another proposal's buyout succeeds, letting the attacker migrate the vault and steal assets.

- Payout: Contest reward
- Severity: high
- Program: Fractional
- Credited: panprog
- Disclosed: 2022-09-27
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/182
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Migration module / settleVault
**Root cause:** settleVault does not verify that the proposal being settled is the one whose buyout actually succeeded; a failed proposal remains committed and can settle once any buyout succeeds.
**Steps:**
1. Bob calls `migrationModule.propose(vault, newModules, plugins, selectors, TOTAL_SUPPLY*2, 1 ether)` with low targetPrice, then `join{value:1 ether}(vault, 1, 4000)` and `commit(vault, 1)` to start a buyout
2. Buyout fails; Bob calls `buyoutModule.end(vault, burnProof)` and `withdrawContribution(vault, 1)` but proposal 1 stays committed
3. Alice proposes (id 2), joins 6000 fractions, commits, buyout succeeds, calls `buyoutModule.end`
4. Bob calls `migrationModule.settleVault(vault, 2)` on his failed proposal; it succeeds instead of reverting with `UnsuccessfulMigration`
5. Bob withdraws all vault tokens into his malicious proposal
**How found:** Code review of migration/buyout state: noticed failed proposals remain committed and settleVault lacks a check tying settlement to the active/successful proposal.
**Exploitation:** Attacker seeds a low-targetPrice migration proposal that triggers a failing buyout, keeps it committed, waits for a victim's proposal to complete a successful buyout, then settles the stale failed proposal to migrate the vault's assets to attacker-controlled modules.
**Insight:** When two subsystems share a 'committed' flag, check whether settlement/withdrawal paths validate that the specific proposal matches the buyout that actually succeeded, not just that some buyout succeeded.