# After endorsing a proposal, user can transfer votes to another user for endorsing the same proposal again

Transferable gOHM voting tokens let a user endorse a proposal then transfer votes to another account to endorse again, double-counting endorsements to reach activation threshold.

- Payout: Contest reward
- Severity: medium
- Program: Olympus DAO
- Credited: rbserver
- Disclosed: 2022-10-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/239
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Governance.sol endorseProposal / activateProposal with transferable gOHM votes
**Root cause:** endorseProposal snapshots VOTES.balanceOf(msg.sender) but does not lock tokens, so votes can be transferred and re-endorsed by a second account, inflating totalEndorsementsForProposal.
**Steps:**
1. voter2 calls `governance.endorseProposal(1)` with 200 votes, totalEndorsements=200
2. voter2 transfers 200 gOHM votes to voter0 via `VOTES.transferFrom(voter2, voter0, 200)`
3. voter0 calls `governance.endorseProposal(1)`, totalEndorsements becomes 400
4. submitter calls `governance.activateProposal(1)`; threshold check passes with 400 though only 200 unique votes exist
**How found:** Read the VOTES stub comment noting it represents gOHM, checked gOHM on Etherscan confirming transfer/transferFrom exist, and reasoned that endorseProposal reads balance without locking, so transferred votes can be re-endorsed.
**Exploitation:** Attacker with enough votes endorses a proposal, transfers the same tokens to a colluding account, which endorses again, doubling counted endorsements to satisfy ENDORSEMENT_THRESHOLD and activate a proposal that lacked genuine support.
**Insight:** When a governance snapshot reads a transferable ERC20 balance at endorsement time without escrowing tokens, the same balance can be replayed across accounts; check whether vote-weight reads are paired with a lock or checkpoint.