# Voters can burn large amounts of Ether by submitting votes with long reason strings

Nouns DAO refund logic includes event-emission gas for arbitrarily long vote reason strings, letting a voter inflate refunds and drain the contract's Ether.

- Payout: Contest reward
- Severity: medium
- Program: Nouns DAO
- Credited: Respx
- Disclosed: 2022-09-30
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-nounsdao-findings/issues/174
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-nounsdao%3AM-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** NounsDAOLogicV2 governance contract castRefundableVoteWithReason
**Root cause:** castRefundableVoteInternal measures refund gas from startGas through the emit VoteCast event, so the cost of emitting an arbitrarily long reason string is refunded; REFUND_BASE_GAS is fixed and does not account for calldata overhead of huge strings.
**Steps:**
1. Deploy with initialBaseFeePerGas 500 gwei and gasPrice 500.
2. Fund the governance contract with Ether.
3. Call `castRefundableVoteWithReason(1, 1, junkString(50_000))` with gasLimit 24000000.
4. Observe user balance diff vs gov balance diff: ~0.25 ETH drained from gov per vote.
**How found:** Code reading of the refund region: noticed startGas is set before the emit VoteCast that includes the unbounded reason string, so event gas is inside the refunded window; tested with a 50k-char string under Hardhat.
**Exploitation:** A Noun holder submits a vote with a very long reason string; the refund calculation covers the gas of emitting the event containing the string, so the contract refunds more than the voter's real overhead, draining Ether from NounsDAOLogicV2. Attacker bears calldata cost but nets a drain roughly equal to it, and can empty remaining funds to deny other voters refunds.
**Escalation:** Repeated across proposals the holder can vote on; draining last funds denies refunds to other voters.
**Insight:** When auditing gas-refund logic, check whether startGas/endGas brackets include event emission or storage writes whose cost scales with user-controlled input length; unbounded string/bytes args inside the refunded window let a caller inflate refunds beyond the fixed base.