# Attacker can DOS private party by donating ETH then calling buy

Unpermissioned buy() lets an attacker donate ETH to a private Party crowdfund, inflating settledPrice and totalVotingPower so quorum is unreachable, softlocking the party and its NFT.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: 0x52
- Disclosed: 2022-11-17
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/196
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-07
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** BuyCrowdfundBase / Crowdfund buy() and governance totalVotingPower
**Root cause:** buy() is callable by anyone even for gatekept private parties, and totalVotingPower is set to _getFinalPrice() (settledPrice) which includes donated ETH that no contributor can claim voting power for.
**Steps:**
1. Wait until the private party crowdfund is filled to just under quorum threshold
2. Attacker donates ETH directly to the crowdfund contract
3. Attacker calls BuyCrowdFund.sol#buy (unpermissioned, does not revert despite gatekeeper)
4. settledPrice now exceeds claimable contributions; totalVotingPower = _getFinalPrice() exceeds total claimable votes
5. No proposal can reach passThresholdBps; party softlocked, NFT inaccessible
**How found:** Code reading of Crowdfund.sol party creation passing _getFinalPrice() as totalVotingPower, combined with noticing BuyCrowdfundBase._getFinalPrice returns settledPrice and that buy() lacks gatekeeper checks.
**Exploitation:** Attacker sends ETH to the crowdfund then triggers buy() as a non-member; the purchase settles at an inflated price, setting governance totalVotingPower above the sum of claimable contributor votes so no proposal can ever pass quorum.
**Escalation:** If emergencyExecuteDisabled is true the party is permanently locked and the NFT is effectively burned; otherwise recovery requires PartyDAO intervention to reclaim the NFT.
**Insight:** When governance voting power is derived from a settle price that includes unsolicited ETH donations, check whether the funding entrypoint is permissionless for gated/private parties — donated value with no claimable votes creates a quorum deadlock.