# In Governance.sol, it might be impossible to activate a new proposal forever after failed to execute the previous active proposal.

Governance lock: if >80% of VOTES are locked in a failed active proposal, no new proposal can reach the 20% endorsement threshold, permanently bricking governance.

- Payout: Contest reward
- Severity: high
- Program: Olympus DAO
- Credited: hansfriese
- Disclosed: 2022-10-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/376
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:dos vuln:governance

**Target:** Governance.sol smart contract (proposal activation and vote reclaim logic)
**Root cause:** Votes cast for an active proposal are held by the contract and cannot be reclaimed while active; activation of a new proposal requires 20% of total VOTES as endorsements, but if >80% are locked in a failed active proposal, the remaining votes are insufficient to meet the threshold.
**Steps:**
1. Submit and activate Proposal 1.
2. Have 81% of total VOTES vote on Proposal 1 (e.g., Yes=47%, No=34%).
3. Proposal 1 fails execution because Yes-No = 13% < 33% required.
4. Voters cannot reclaim their VOTES while Proposal 1 remains active.
5. Attempt to activate a new proposal: `activateProposal()` requires endorsements >= 20% of total VOTES, but only 19% are available.
6. Governance is permanently stuck: no new proposal can be activated, and Proposal 1 cannot be replaced.
**How found:** Code review of Governance.sol: noticed that votes are locked while a proposal is active and that activation requires 20% endorsements; reasoned that a failed proposal with >80% participation would leave insufficient votes to meet the threshold.
**Exploitation:** An attacker (or accidental majority) can intentionally vote with >80% of tokens on a proposal designed to fail execution, locking those votes indefinitely and preventing any future proposal from being activated, effectively a governance DoS.
**Insight:** In governance contracts, check for liveness assumptions: thresholds that depend on the distribution of locked tokens can be exploited to permanently freeze the system if a large fraction of tokens can be locked in a failing state.