#  A majority attack can steal precious NFT from the party by crafting and chaining two proposals

A 51% majority chains a FractionalizeProposal and ArbitraryCallsProposal to transfer all vault ERC20 tokens to themselves, then redeems the party's NFT.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: Trust
- Disclosed: 2022-11-17
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/277
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:governance

**Target:** PartyGovernance ProposalExecutionEngine / FractionalizeProposal
**Root cause:** FractionalizeProposal mints vault ERC20 tokens to the party but does not immediately distribute them, leaving a window where a majority can pass an ArbitraryCallsProposal to transfer the entire token supply out before distribute() is called.
**Steps:**
1. Off-chain compute target_nonce = current VAULT_FACTORY nonce + (fractionalization rate * 1.2 * execution delay); compute target_vault = keccak256(VAULT_FACTORY, target_nonce) and before_target_vault = keccak256(VAULT_FACTORY, target_nonce-1)
2. Deploy attack contract with attack() that loops: mint dummy attacker_NFT, created_vault = VAULT_FACTORY.mint(attacker_NFT) until created_vault == before_target_vault
3. Propose FractionalizeProposal with precious NFT and any list price
4. Propose ArbitraryCallsProposal with target=target_vault, data=`transfer(ATTACKER, totalVotingPower)`
5. Set execute() params on attack contract using allocated proposalIDs
6. Wait for execution delay
7. Run attack(): burn nonces until target_vault created, call execute() on FractionalizeProposal then ArbitraryCallsProposal
8. Call `vault.redeem()` to burn token supply and receive the NFT
**How found:** Reasoning about the system's defenses: majority cannot exfiltrate ETH from NFT sales and cannot sell NFT for non-ETH assets, but FractionalizeProposal mints ERC20 tokens to the party without immediate distribution, creating a window an ArbitraryCallsProposal can exploit. The chicken-and-egg of the unknown vault address was solved with heap-feng-shui nonce grinding.
**Exploitation:** Attacker holding >50% voting power crafts two proposals executed back-to-back: fractionalize the NFT to mint totalVotingPower vault tokens to the party, then immediately use ArbitraryCallsProposal to transfer all vault tokens to the attacker. Heap-feng-shui nonce grinding ensures the vault address is known in advance so both proposals can be chained before anyone calls distribute(). Attacker then redeems tokens for the NFT.
**Escalation:** Chaining two proposals plus pre-computing the CREATE address via nonce grinding to close the timing window before distribute() is called.
**Insight:** When a protocol mints claim tokens to a contract and relies on a later distribute() call, look for a window where a privileged proposal can move those tokens first; and note that CREATE address predictability (factory nonce) can be ground to pre-target a not-yet-deployed contract.