# A proposal can pass with 0 votes in favor at early DAO stages

Freshly deployed Nouns Builder DAOs round quorum and proposal thresholds to zero, letting an attacker pass a self-serving proposal with no votes and seize treasury powers.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: azephiar
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/436
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-17
- Tags: domain:web3 impact:funds-loss impact:privesc kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:governance

**Target:** Governor/Treasury governance contracts of freshly deployed DAOs
**Root cause:** quorumVotes and proposalThreshold are computed as totalSupply * bps / 10_000, which rounds to 0 when supply is low; a proposal with 0 for-votes and 0 quorum still reaches Succeeded.
**Steps:**
1. Deploy or watch for a new DAO via `DAODeployed` event on Manager.sol where `totalSupply * quorumThresholdBps < 10_000` and `totalSupply * proposalThresholdBps < 10_000`.
2. Call `governor.propose(targets, values, calldatas, '')` with calldatas: `updateVetoer(attacker)`, `updateVotingDelay(0)`, `updateVotingPeriod(0)`, `treasury.updateGracePeriod(0)`, `treasury.updateDelay(1 day)`.
3. Warp to `proposal.voteEnd` without any votes; call `governor.queue(proposalId)`.
4. Warp `treasury.delay()` and call `governor.execute(...)` to install attacker as vetoer and zero delays.
5. Submit second proposal and queue immediately; execute after 1 day to drain any treasury bids.
**How found:** Code reading of Governor state logic: noticed quorumVotes/proposalThreshold derive from totalSupply via bps division, so early DAOs get 0 thresholds; confirmed a 0-vote proposal still returns Succeeded.
**Exploitation:** Attacker script monitors DAODeployed, front-runs governance by submitting a proposal during zero-supply window; with quorum/threshold at 0 the proposal passes unopposed, granting vetoer role and zeroing delays so subsequent malicious proposals can be queued and executed before legitimate holders can react.
**Escalation:** First proposal grants veto power over competing proposals and removes time delays, enabling repeated treasury-draining proposals.
**Insight:** Whenever quorum or proposal thresholds are computed by scaling totalSupply with basis points, check the rounding boundary at low supply — a fresh deployment is a governance window where thresholds collapse to zero.