# Quorum votes have no effect for determining whether proposal is defeated or succeeded when token supply is low

Governor.quorum() rounds to 0 when token supply is low, so proposals pass with zero quorum votes, letting a single voter queue treasury-draining proposals.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: rbserver
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/607
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** Governor governance contract (Solidity)
**Root cause:** quorum() computes totalSupply * quorumThresholdBps / 10_000 with integer division, returning 0 when supply is small; propose() stores that 0 as proposal.quorumVotes, and state()'s `forVotes < quorumVotes` check is then always false.
**Steps:**
1. Deploy DAO with low token supply (e.g. 4 tokens) so `(totalSupply * quorumThresholdBps) / 10_000 == 0`.
2. Call `governor.propose(targets, values, calldatas, "test")`; `proposal.quorumVotes` is set to 0.
3. Warp past votingDelay, call `governor.castVote(proposalId, 1)` with a single voter.
4. Warp past votingPeriod; `governor.state(proposalId)` returns Succeeded since `forVotes < quorumVotes` is false.
5. Call `governor.queue(proposalId)`; proposal reaches Queued and can be executed.
**How found:** Code reading of quorum() integer division and tracing proposal.quorumVotes into the state() defeat condition; confirmed with a Foundry test at supply 4.
**Exploitation:** A single token holder at low supply proposes and votes, bypassing quorum entirely, then queues and executes proposals such as implementation upgrades or treasury withdrawals without meaningful approval.
**Escalation:** Judge noted totalSupply can be zero (no founder mint), enabling griefing such as setting allowances to set up a future rug-pull.
**Insight:** When a governance threshold is derived by integer division of supply, check the low-supply regime where the divisor rounds the threshold to zero; snapshot-time quorum stored per proposal inherits the flaw.