# Voted votes cannot change after the user is issued new votes or the user's old votes are revoked during voting

Governance.vote snapshots user votes once; later issueVotesTo/revokeVotesFrom change total supply mid-vote, making quorum/execution results inconsistent.

- Payout: Contest reward
- Severity: medium
- Program: Olympus DAO
- Credited: rbserver
- Disclosed: 2022-10-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/275
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AM-10
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic vuln:governance

**Target:** Governance/VoterRegistration Solidity contracts
**Root cause:** vote() records userVotesForProposal once and blocks re-voting, but voter_admin can mint/burn VOTES during the active proposal, so recorded yes/no tallies diverge from the live total supply used for quorum.
**Steps:**
1. Deploy Governance with active proposal; voter3 calls `governance.vote(true)` with 300 votes, recorded in userVotesForProposal and yesVotesForProposal.
2. voter_admin calls `VOTES.mintTo(voter3, 500)` (issueVotesTo); voter3 cannot vote again — `vote` reverts UserAlreadyVoted.
3. Alternatively voter_admin calls `revokeVotesFrom(voter3, 300)`; `VOTES.burnFrom` reverts with arithmetic underflow since voter3 balance is 0 after transfer to governance.
4. Proposal tallies still reflect stale 300 votes while total supply changed, skewing quorum/execution checks.
**How found:** Code review of Governance.vote's one-shot userVotesForProposal check against VoterRegistration.issueVotesTo/revokeVotesFrom, noticing the recorded votes are never reconciled with supply changes during voting; confirmed with Foundry tests.
**Exploitation:** A privileged voter_admin (or compromised admin) can mint or burn votes during an active proposal to shift total supply relative to already-cast votes, altering whether quorum/execution thresholds are met without voters being able to update their recorded votes.
**Insight:** When a voting contract snapshots per-user weight but a privileged role can mint/burn the underlying token mid-vote, quorum math desyncs — check whether tallies and total supply are read from the same frozen snapshot.