# PartyGovernance: Can vote multiple times by transferring NFT in same block as proposal

PartyGovernance snapshots voting power at proposal time, so transferring the NFT and re-voting in the same block lets any holder pass proposals and steal party assets.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: Lambda
- Disclosed: 2022-11-17
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/113
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:governance

**Target:** PartyGovernance / PartyGovernanceNFT voting contract
**Root cause:** Voting power for accept() is read at the proposal's creation time rather than a finalized past snapshot, so current NFT ownership can be moved and re-used to vote again within the same block.
**Steps:**
1. Create governance with 100e18 total VP; give undelegatedVoter 50e18 VP.
2. undelegatedVoter calls `propose(proposal, 0)` to create proposalId.
3. Call `transferVotingPower(undelegatedVoter, recipient, 50e18)` to simulate NFT transfer in same block.
4. recipient calls `accept(proposalId, 0)`; votes now total 100e18.
5. Repeat transfer/vote across wallets to accumulate arbitrary voting power and pass proposal unanimously.
**How found:** Noticed voting power is evaluated at proposal time (mutable current state) rather than a finalized past snapshot, hypothesizing same-block transfer could double-count votes; confirmed with a Foundry test diff.
**Exploitation:** Attacker with any non-zero voting power proposes a malicious proposal, then in the same block transfers the NFT/voting power to another owned wallet and votes again, repeating until quorum is reached; the proposal executes and drains all party assets including precious tokens.
**Escalation:** Looping the transfer-and-vote across many wallets scales voting power arbitrarily, enabling unanimous passage of any proposal and theft of all assets.
**Insight:** When a governance contract reads voting power from live/current state instead of a finalized past snapshot (proposedTime-1), test same-block transfer-and-revote to inflate quorum.