# Delegation should not be allowed to address(0)

Delegating votes to address(0) in Nouns Builder ERC721Votes underflows vote accounting, burning voting power and wrapping to type(uint192).max on repeat delegation.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: davidbrai
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/203
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-08
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** ERC721Votes.sol _delegate voting-power accounting
**Root cause:** The _delegate function reads prevDelegate from delegation[_from] instead of delegates(_from), so when delegating to address(0) the previous delegate is not the actual current delegate, causing votes(_from) to be decremented without a matching prior increment and underflowing.
**Steps:**
1. Mint/win one NFT for user U so votes(U)=1
2. Call `token.delegate(address(0))` as U; prevDelegate resolves to U, so votes(U)-- to 0
3. Call `token.delegate(address(0))` again as U; votes(U)-- underflows to type(uint192).max
**How found:** Code review of _delegate accounting; noticed prevDelegate sourced from delegation[_from] rather than delegates(_from), then reasoned about the address(0) edge case and wrote a Foundry PoC.
**Exploitation:** A token holder repeatedly delegates to address(0), first burning their own voting power to zero, then underflowing votes(U) to 2^192-1, granting themselves effectively unlimited voting weight in governance.
**Escalation:** Underflowed vote balance (type(uint192).max) could let the attacker dominate any governance vote in the DAO.
**Insight:** When auditing vote/delegation accounting, test the address(0) delegate edge case and check that the 'previous delegate' is read via the same accessor (delegates()) used elsewhere, otherwise decrement-without-increment underflows.