# It is possible to steal the unallocated part of every delegation period budget

Ajna grants slate validation accepts proposals with dust funding votes, letting an attacker claim each period's unallocated budget via a self-transfer proposal.

- Payout: Contest reward
- Severity: medium
- Program: Ajna Protocol
- Credited: hyh
- Disclosed: 2023-06-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/465
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** StandardFunding.sol grants distribution slate validation
**Root cause:** _validateSlate only rejects proposals with negative fundingVotesReceived and the top-slate update only requires a greater sum of funding votes, so a proposal with near-zero votes can be included and paid the unallocated remainder.
**Steps:**
1. Monitor end of each screening period for low-activity periods where viable proposals don't fill the 90% GBC budget.
2. Call `proposeStandard()` with a proposal transferring the remainder to self.
3. Call `fundingVote()` with dust votes so the proposal enters `_topTenProposals`.
4. Call `updateSlate()` repeating the current top slate plus the attacker proposal; since sum of funding votes increases, it becomes the new top slate.
5. After challenge period, execute and receive the unallocated remainder.
**How found:** Code review of _validateSlate and top-slate update logic: noticed only negative fundingVotesReceived is rejected and slate improvement requires merely a greater vote sum, implying zero/dust-vote proposals can win.
**Exploitation:** Attacker needs only dust governance tokens; submits self-transfer proposal, votes dust, updates slate to include it, and after the challenge period executes to drain the period's unallocated budget.
**Escalation:** Repeatable each period; monitoring automation scales theft across periods.
**Insight:** In grant/funding slate logic, check whether the 'better slate' comparison and per-proposal validation enforce a minimum vote threshold; a strictly-greater sum check lets dust-vote proposals capture leftover budget.