# Early contributor can always become majority of crowdfund leading to rugging risks.

Attacker calls buy() using only part of crowdfund contributions plus own funds, gaining majority voting power in the created party and enabling rugging.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: Trust
- Disclosed: 2022-11-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/284
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AM-08
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** BuyCrowdfund / CollectionBuyCrowdfund buy() voting power distribution
**Root cause:** Voting power is computed as contribution divided by the actual NFT purchase price, not the total crowdfund balance. An attacker who triggers buy() with a price below total deposits gets voting power proportional to a smaller denominator, inflating their share.
**Steps:**
1. Victim A deposits 20 ETH into BuyCrowdfund
2. Attacker deposits 30 ETH
3. Victim B deposits 50 ETH (total 100 ETH)
4. Attacker calls `buy()` with buy price 59 ETH; attacker's contract supplies the remaining 41 ETH
5. Voting power: A 20/59, attacker 30/59, B 9/59 — attacker has majority
6. Attacker uses majority to execute a party takeover vector and extract the NFT
**How found:** Reasoned about how voting power is derived from contribution divided by NFT purchase price rather than total deposits, realizing a caller-controlled buy price lets an early contributor inflate their share.
**Exploitation:** Attacker contributes 30 ETH, then calls buy() requesting only 59 ETH of the 100 ETH crowdfund, adding 41 ETH externally. Because voting power = contribution / buy price, attacker holds 30/59 majority. Combined with a separate majority-attack vector, attacker steals the NFT, netting NFT value minus external and own contribution.
**Escalation:** Chains with separate majority-rule exploitation vectors (detailed in other reports) to convert voting majority into NFT theft.
**Insight:** When share/voting power is computed against a caller-influenced denominator (purchase price) rather than total pooled capital, the caller can shrink the denominator to inflate their own fraction — check every ratio whose divisor is attacker-selectable.