# Tokens with multiple entry points can lead to loss of funds in rageQuit()

rageQuit() dedupes tokens by address only, so a token with two entry-point addresses is withdrawn twice, letting a member drain more than their share.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: adriro
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-party-findings/issues/14
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-party%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PartyGovernanceNFT.rageQuit() token withdrawal loop
**Root cause:** Duplicate protection only compares token addresses in ascending order; a token reachable via two distinct addresses passes the check and its balance is counted/transferred once per address.
**Steps:**
1. Party holds 100 units of token T, reachable at addresses A and B.
2. Alice holds 50% voting power NFT.
3. Alice calls `rageQuit(receiver, 50e16, [A, B])` with A < B so ordering check passes.
4. Loop transfers `balanceOf(this)*50%` for A (50 units), then again for B (25 units of remaining balance).
5. Alice receives 75 units instead of 50; other members lose funds.
**How found:** Code review of the withdrawTokens loop: noticed dedupe relies solely on address ordering, then recalled the 'weird ERC20' multiple-token-addresses pattern (e.g. TrueUSD) where one token has two addresses.
**Exploitation:** A party member calls rageQuit() passing both entry-point addresses of a dual-address token; each iteration recomputes share from current balance and transfers, extracting more than the entitled share at other members' expense.
**Insight:** When a contract dedupes an attacker-supplied token list by address, check whether the underlying asset can be represented by multiple addresses (proxy/legacy entry points like TrueUSD); balance-snapshot comparison across the loop catches aliasing that address dedupe misses.