# OlympusGovernance: Users can prevent their votes from being revoked

Users can park VOTES inside Governance's userVotesForProposal via vote+reclaim in one tx, keeping balance 0 so voter_admin's revokeVotesFrom cannot burn them.

- Payout: Contest reward
- Severity: medium
- Program: Olympus DAO
- Credited: cccz
- Disclosed: 2022-10-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/308
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AM-11
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** Governance/VoterRegistration Solidity contracts (vote, reclaimVotes, revokeVotesFrom)
**Root cause:** revokeVotesFrom only burns the wallet's VOTES balance, but VOTES held in Governance's userVotesForProposal mapping are unreachable by voter_admin and reclaimable only by the user.
**Steps:**
1. voter_admin mints VOTES to user via VoterRegistration.
2. User calls `vote(proposalId, amount)` sending VOTES to Governance, recorded in `userVotesForProposal[proposalId][user]`.
3. User calls `reclaimVotes(proposalId)` to pull VOTES back, then `vote` again, atomically in one transaction.
4. Wallet VOTES balance stays 0, so `revokeVotesFrom(wallet, amount)` burns nothing while votes remain recorded.
**How found:** Code reading of VoterRegistration.revokeVotesFrom (burns wallet balance) versus Governance.vote/reclaimVotes (escrow in userVotesForProposal), spotting the accounting gap between wallet balance and escrowed votes.
**Exploitation:** User loops vote+reclaim in a single tx so their on-wallet VOTES balance is always zero; voter_admin's revokeVotesFrom cannot burn the parked tokens, letting the user retain voting power and potentially dominate proposals if others are revoked.
**Escalation:** If A and B are revoked but C parks votes, C holds all VOTES and can pass any proposal.
**Insight:** When an admin revoke/burn function targets only a wallet balance, check for escrow mappings (votes, stakes, deposits) where the same tokens can be parked and are only releasable by the owner — the revoke path silently misses them.