# NFT owner can block token burning and transfer by delegating to zero address

Delegating votes to address(0) zeroes an owner's checkpoint votes, so later transfers/burns underflow and revert, permanently locking the NFT.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: hyh
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/478
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-07
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC721Votes governance token contract (delegate/delegateBySig)
**Root cause:** delegate()/delegateBySig() permit _to == address(0); _moveDelegateVotes subtracts the owner's votes but adds none to the zero address, leaving the checkpoint at zero.
**Steps:**
1. Owner calls `delegate(address(0))`; _delegate sets delegation[owner]=0 and _moveDelegateVotes(prev,0,balanceOf(owner)) subtracts votes, skipping the `_to != address(0)` add branch.
2. Owner's checkpoint votes become 0.
3. Any transfer or burn of the owner's tokenId triggers _afterTokenTransfer -> _moveDelegateVotes(_from,_to,1), computing `prevTotalVotes - 1` on a zero balance and reverting on underflow.
4. Token is permanently non-transferable and non-burnable.
**How found:** Code review of ERC721Votes delegation path: noticed _moveDelegateVotes treats _to==address(0) as a burn, so zero-address delegation silently erases votes, then traced _afterTokenTransfer's unconditional 1-vote subtraction to an underflow.
**Exploitation:** Owner deliberately delegates to zero to make their own token IDs untransferable/unburnable, interfering with auction-failure burning and governance flows; no external attacker gain, self-inflicted lock.
**Insight:** When a vote/balance accounting function special-cases address(0) as 'burn', check whether user-facing setters can pass address(0) as a destination; the asymmetric subtract-without-add leaves state that later decrements underflow.