# Anyone can pass any proposal alone before first VOTES are minted

Governance vote checks pass when VOTES.totalSupply()==0, letting anyone submit, activate and execute a proposal to seize Kernel admin/executor before first mint.

- Payout: Contest reward
- Severity: high
- Program: Olympus DAO
- Credited: Bahurum
- Disclosed: 2022-10-26
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/392
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AH-02
- Tags: domain:web3 impact:funds-loss impact:privesc kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** Governance.sol policy contract (on-chain governance)
**Root cause:** Proposal activation/execution quorum checks compare against VOTES.totalSupply(), which is 0 before any VOTES are minted, so thresholds trivially pass with zero votes cast.
**Steps:**
1. Deploy attacker contract `MockMalicious`.
2. Call `governance.submitProposal([Instruction(Actions.ChangeAdmin, attacker), Instruction(Actions.ChangeExecutor, attacker)], name, uri)` as attacker.
3. Call `governance.endorseProposal(1)` and `governance.activateProposal(1)` — checks at L164/L217-218 pass since totalSupply==0.
4. `vm.warp(block.timestamp + 3 days + 1)` then `governance.executeProposal()` (L268 check passes).
5. Assert `kernel.executor()==attacker` and `kernel.admin()==attacker`.
**How found:** Code-reading of Governance.sol vote-count checks (L164, L217-218, L268) noticing they compare against VOTES.totalSupply(), which is zero before minting; confirmed via modified Governance.t.sol setUp truncated before VOTES mint.
**Exploitation:** Attacker frontruns the first VOTES minting, submits a proposal changing Kernel admin and executor to an attacker-controlled contract, endorses/activates/executes it with zero votes, then upgrades malicious modules and drains treasury funds.
**Escalation:** Kernel admin+executor control grants access to all permissioned functions and treasury funds.
**Insight:** When governance thresholds are expressed relative to totalSupply(), audit the bootstrap window where supply is zero — quorum/approval math that divides or compares against supply silently passes with no voters.