# An attacker can contribute to the ETH crowdfund using a flash loan and control the party as he likes

Flash-loan contribution to ETH crowdfund lets attacker exceed maxTotalContributions, gain 55% voting power, and distribute party ETH same block to repay loan.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: hansfriese
- Disclosed: 2023-06-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-party-findings/issues/25
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:governance

**Target:** ETHCrowdfundBase / PartyGovernance distribution flow
**Root cause:** Crowdfund finalizes immediately when total contributions exceed maxTotalContributions, and PartyGovernance.distribute() can be called in the same block with no cooldown, so a flash-loaned contribution can be repaid from the party's own distributed ETH.
**Steps:**
1. Set maxContribution=uint96.max, minTotalContributions=10 ether, maxTotalContributions=20 ether, fundingSplitBps=0.
2. Attacker contributes 1 ether; honest member contributes 9 ether.
3. Attacker flash-borrows 10 ether and calls `contributeFor{value:10 ether}(1, attacker, attacker, "")`, pushing total to 20 ether and finalizing crowdfund.
4. Attacker now holds 11/20 = 55% voting power.
5. Attacker calls `party.distribute(19 ether, Native, address(0), 0)` (directly if distributionsRequireVote==false, else via proposal in same block).
6. Attacker calls `distributor.claim(distInfo, 1)` receiving 10.45 ether, repays 10 ether flash loan, retains control.
**How found:** Observed that crowdfund finalization and distribute() can occur in the same block with no cooldown, and that voting power is proportional to contribution, enabling a flash-loan-funded majority stake repaid from the party's own ETH.
**Exploitation:** Flash-borrow ETH to push contribution over maxTotalContributions, finalizing crowdfund and granting majority voting power; immediately trigger distribute() and claim() to extract ETH proportional to voting power, repaying the loan in the same block and keeping governance control.
**Escalation:** Retained 55% voting power after repayment, allowing attacker to pass arbitrary proposals and control the party indefinitely.
**Insight:** When governance weight is set at finalization and treasury distribution has no time delay, check whether a flash loan can buy majority power and be repaid from the same distribution in one block; executionDelay=0 is the enabling condition.