# A proposal can be cancelled by anyone if the proposal has exactly proposalThreshold votes

Governor.cancel uses strict > against proposalThreshold while propose uses >=, so anyone can cancel a proposal whose proposer holds exactly threshold votes.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: davidbrai
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/194
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** Governor.sol cancel() access check
**Root cause:** propose() requires getVotes >= proposalThreshold, but cancel() only blocks cancellation when getVotes(proposer) > proposalThreshold, so equality falls through to the cancel path.
**Steps:**
1. Deploy DAO with proposalThresholdBps such that proposalThreshold()==1
2. Mint tokens so voter1 holds exactly 1 vote (== threshold)
3. voter1 calls `governor.propose(targets, values, calldatas, "test")` — succeeds
4. randomUser calls `governor.cancel(proposalId)` — succeeds because getVotes(proposer) > threshold is false
5. Proposal state becomes Canceled
**How found:** Compared the inequality in propose() (>= threshold) against cancel() (> threshold) and noticed the boundary mismatch.
**Exploitation:** Any address calls cancel() on a pending proposal whose proposer's current vote weight equals the threshold; the strict > check fails to block, cancelling the proposal and burning the proposal ID so it cannot be resubmitted.
**Escalation:** If all DAO members hold <= proposalThreshold votes, every proposal can be cancelled by anyone, halting governance.
**Insight:** When auditing governance, diff the exact comparison operators across propose/cancel/execute paths for the same threshold — an off-by-one in one guard lets an unrelated party grief proposals at the boundary value.