# Possible DOS attack using dust in ReraiseETHCrowdfund._contribute()

Attacker frontruns a victim's contributeFor with 1 wei, minting their crowdfund NFT at zero voting power so the victim's real contribution reverts on duplicate mint.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: hansfriese
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-party-findings/issues/18
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** ReraiseETHCrowdfund._contribute() / contributeFor()
**Root cause:** NFT mint is gated on previousVotingPower==0 rather than positive voting power; a dust contribution that rounds votingPower to 0 mints the NFT while leaving pendingVotingPower at 0, so the next contribution attempts a duplicate mint and reverts.
**Steps:**
1. Set exchangeRateBps=5e3 and minContributions=0 so 1 wei yields 0 voting power.
2. Attacker calls `crowdfund.contributeFor{value:1}(payable(honest), honest, "")` frontrunning the victim.
3. NFT minted for honest user; pendingVotingPower(honest)==0.
4. Victim calls `crowdfund.contribute{value:1 ether}(honest, "")`; previousVotingPower==0 triggers `_mint` again, reverting with AlreadyMintedError.
**How found:** Code reading of _contribute(): noticed mint condition uses previousVotingPower==0 while votingPower can round to zero for small amounts, then constructed a frontrun scenario with low exchangeRateBps.
**Exploitation:** Attacker needs only 1 wei and mempool visibility of the victim's contribution; frontruns contributeFor to pre-mint the victim's NFT at zero voting power, permanently blocking that user's contribution for the crowdfund duration.
**Insight:** When a mint/registration is gated on a stored counter that can stay zero after a successful write (rounding to zero), check whether an attacker can pre-trigger the write cheaply to grief the legitimate first real action.