# The quorum votes calculations don't take into account burned tokens

Nouns Builder quorum uses totalSupply including burned and auction-held tokens, so quorum can exceed real voting power and block proposals.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: azephiar
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/423
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** Governor.sol quorum/proposalThreshold calculations
**Root cause:** quorum() and proposalThreshold() derive from token.totalSupply(), but burned tokens and tokens held by the auction contract retain no voting power, inflating the effective quorum threshold.
**Steps:**
1. Run 130 auctions, bid on first 10, let rest settle with no bidders so tokens burn
2. Create proposal via `governor.propose(...)`
3. Warp to voteStart and cast all available votes `for`
4. Warp to voteEnd and call `governor.queue(proposalId)`
5. Observe revert `PROPOSAL_UNSUCCESSFUL()` because forVotes < quorumVotes
**How found:** Reasoned that burn() deletes delegate votes via _moveDelegateVotes while totalSupply is unchanged, and that _createAuction mints tokens held by the auction contract; both reduce real voting power relative to totalSupply used in quorum math.
**Exploitation:** No attacker action; the flaw manifests naturally as unsold auctions burn tokens, raising effective quorum above reachable voting power and locking proposals/funds.
**Insight:** When auditing governance quorum/threshold math, check whether the supply denominator includes non-voting balances (burned, escrowed, auction-held) and whether the reference implementation (NounsDAO) mutates totalSupply on burn.