# ReraiseETHCrowdfund#claimMultiple can be used to grief large depositors

Anyone can call claimMultiple for another contributor, fragmenting their voting power into many low-power NFTs and inflating their future gas costs.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: 0x52
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-party-findings/issues/35
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ReraiseETHCrowdfund#claimMultiple
**Root cause:** claimMultiple accepts a caller-supplied votingPowerByCard array and can be invoked by anyone for any contributor, so a griefer controls how a victim's voting power is split across minted cards.
**Steps:**
1. Victim contributes 100 with minContribution=1, maxContribution=100, qualifying for one max-size card.
2. Attacker calls `claimMultiple(contributor=victim, votingPowerByCard=[1,1,...])` with 100 entries of 1.
3. Loop mints 100 party cards of 1 voting power each to the victim instead of one card of 100.
4. Victim must later pay gas to manage/transfer many NFTs.
**How found:** Code reading of the claimMultiple loop: noticed the votingPowerByCard array is caller-controlled and the function lacks a msg.sender==contributor restriction, then reasoned about fragmenting a large deposit into many minimum-size cards.
**Exploitation:** Attacker front-runs or preempts the victim's own claim by calling claimMultiple on their behalf with a maximally fragmented votingPowerByCard array, forcing many small NFTs and high gas costs for the victim.
**Insight:** When a claim/mint function lets any caller specify how a victim's balance is split into tokens, check whether array-length or per-card sizing is attacker-controlled; griefing via NFT fragmentation raises victim gas and can dilute governance usability.