# State function does not require majority of votes for supporting and passing a proposal

Nouns Builder Governor.state uses strict `<` so a proposal with forVotes equal to againstVotes (50/50) at quorum is Succeeded and can be queued/executed.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: rbserver
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/626
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-28
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Governor.sol state() proposal lifecycle logic
**Root cause:** Defeat condition uses `proposal.forVotes < proposal.againstVotes` instead of `<=`, so an exact tie at or above quorum is not Defeated and falls through to Succeeded.
**Steps:**
1. Deploy DAO, unpause auction, create 7 voters with 5 ether.
2. Set quorum threshold bps to 2000 via `governor.updateQuorumThresholdBps(2000)`.
3. Create proposal, warp past `votingDelay()`.
4. Cast 2 for, 2 against, 3 abstain votes.
5. Warp past `votingPeriod()`; `governor.state(proposalId)` returns Succeeded.
6. Call `governor.queue(proposalId)`; state becomes Queued, enabling execution.
**How found:** Code review of the state() branch conditions, noticing the strict `<` comparison between forVotes and againstVotes fails to defeat an exact tie.
**Exploitation:** A proposer who can split votes to an exact 50/50 tie at quorum gets a proposal (e.g. implementation upgrade or treasury withdrawal) marked Succeeded and queued despite lacking majority support.
**Insight:** In governance state machines, audit the exact comparison operators on vote tallies and quorum: ties and boundary equality are where pass/fail semantics silently diverge from the intended 'majority' definition.