# PartyGovernanceNFT.sol: burn function does not reduce totalVotingPower making it impossible to reach unanimous votes

PartyGovernanceNFT.burn reduces mintedVotingPower and owner voting power but not totalVotingPower, so after a burn unanimous votes become unreachable and remaining votes are diluted.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: HollaDieWaldfee
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-party-findings/issues/10
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** PartyGovernanceNFT.burn in Party protocol governance contract
**Root cause:** burn() decrements mintedVotingPower and adjusts the owner's voting power but never subtracts the burned votingPower from _governanceValues.totalVotingPower, leaving the denominator used by _isUnanimousVotes stale.
**Steps:**
1. Mint three party cards of equal voting power vp to voter1/2/3; totalVotingPower = 3*vp.
2. As voter1, call `nft.burn(token1)`.
3. Observe `getGovernanceValues().totalVotingPower` unchanged at 3*vp while mintedVotingPower drops to 2*vp.
4. Remaining voters can only reach 2*vp/3*vp ≈ 83%, so `_isUnanimousVotes(pv.votes, totalVotingPower)` never passes.
**How found:** Read the new burn() function introduced for InitialETHCrowdfund refunds, noticed it updates mintedVotingPower and per-owner voting power but not totalVotingPower, then traced totalVotingPower into _isUnanimousVotes to confirm the denominator stays stale.
**Insight:** When a token/NFT burn path is added for one use case (crowdfund refunds) and later opened to all users, check every aggregate counter the burn touches—mintedVotingPower was decremented but totalVotingPower was not, breaking unanimity math.