# The voting thresholds in Ajna's Extraordinary Funding Mechanism can be manipulated to execute proposals below the expected threshold

Ajna's Extraordinary Funding threshold uses live total supply, so a large holder can burn tokens to lower the quorum and pass an under-voted treasury-draining proposal.

- Payout: Contest reward
- Severity: medium
- Program: Ajna Protocol
- Credited: bytes032
- Disclosed: 2023-06-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/285
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** Extraordinary Funding Mechanism grant governance contract (ExtraordinaryFunding.sol)
**Root cause:** _getSliceOfNonTreasury computes the minimum vote threshold from the current ajnaToken totalSupply, which any holder can reduce by burning ERC20Burnable tokens, shrinking the required quorum.
**Steps:**
1. Create an extraordinary proposal requesting a large slice of treasury (e.g. 20%) via proposeExtraordinary.
2. Accumulate votes below the required threshold (e.g. 61% when 70% needed).
3. Burn own Ajna tokens to reduce totalSupply, lowering _getSliceOfNonTreasury(minThresholdPercentage).
4. Re-check _extraordinaryProposalSucceeded: votesReceived now >= tokensRequested_ + reduced slice.
5. Advance to end block, call state()/execute to release treasury funds to attacker.
**How found:** Code review of _extraordinaryProposalSucceeded and _getSliceOfNonTreasury revealed the threshold derives from live totalSupply; noting AjnaToken inherits ERC20Burnable, the researcher hypothesized supply reduction lowers quorum and confirmed with a Foundry test comparing tokensNeeded with and without a burn.
**Exploitation:** A whale holding a large token share submits a treasury-extraction proposal, gathers partial votes, then burns a portion of their own supply so the computed minimum threshold drops below their accumulated votes, letting the proposal succeed and drain treasury tokens.
**Insight:** When a governance quorum is computed from live token supply rather than a proposal-time snapshot, check every supply-mutating path (burn, rebase, mint) as a quorum-lowering lever.