# ETHCrowdfundBase.sol: totalVotingPower is increased too much in the _finalize function

ETHCrowdfundBase._finalize increases totalVotingPower using pre-fee contributions while users get post-fee voting power, making unanimous votes impossible and potentially locking funds.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: HollaDieWaldfee
- Disclosed: 2023-06-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-party-findings/issues/11
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** ETHCrowdfundBase._finalize / PartyGovernanceNFT voting power accounting
**Root cause:** _processContribution subtracts funding fees before computing a user's votingPower, but _finalize computes newVotingPower from totalContributions without subtracting the funding fee, so totalVotingPower exceeds the sum of individual voting powers.
**Steps:**
1. Deploy crowdfund with fundingSplitBps=1000 and a fundingSplitRecipient.
2. Two members each contribute 1 ether via `crowdfund.contribute{value:1 ether}(member, "")`.
3. Skip past duration and call `crowdfund.finalize()`.
4. Observe `party.getGovernanceValues().totalVotingPower` == 2e18 while each member's `pendingVotingPower` == 0.9e18 (sum 1.8e18).
5. Unanimous vote threshold (100% of totalVotingPower) becomes unreachable.
**How found:** Code reading of _processContribution vs _finalize: noticed voting power is computed after fee subtraction for users but before fee subtraction for totalVotingPower, then confirmed with a Foundry PoC comparing totalVotingPower to sum of pendingVotingPower.
**Exploitation:** Precondition: crowdfund configured with nonzero fundingSplitBps. On finalize, totalVotingPower is inflated by the fee amount relative to minted voting power, so proposals requiring high quorum/unanimity can never pass, potentially blocking execution of proposals and stranding party funds.
**Insight:** When a contract maintains both a per-user accounting value and an aggregate total, check that both are derived from the same post-adjustment base; fee/split deductions applied in one path but not the aggregate path silently break quorum math.