# In LlamaRelativeQuorum, the governance result might be incorrect as it counts the wrong approval/disapproval

LlamaRelativeQuorum mixes holder-count supply with weighted quantity approvals, letting a single high-quantity holder meet quorum alone.

- Payout: Contest reward
- Severity: high
- Program: Llama
- Credited: auditor0517
- Disclosed: 2023-07-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-llama-findings/issues/203
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-llama%3AH-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** LlamaRelativeQuorum governance strategy contract
**Root cause:** validateActionCreation stores approval/disapproval supply as number of role holders via getRoleSupplyAsNumberOfHolders, but getApprovalQuantityAt/getDisapprovalQuantityAt return weighted quantity, so numerator and denominator use different metrics.
**Steps:**
1. Deploy LlamaRelativeQuorum with minApprovalPct=51%.
2. Create 3 role holders Alice, Bob, Charlie; set Alice quantity=2, others=1.
3. Create action: actionApprovalSupply=3 (holders).
4. Alice alone approves; getApprovalQuantityAt returns 2, 2/3 > 51%, action queued with one approval.
**How found:** Code reading: noticed supply set via getRoleSupplyAsNumberOfHolders while counting uses getPastQuantity, a metric mismatch between numerator and denominator.
**Exploitation:** A single role holder with elevated quantity can single-handedly pass governance actions, bypassing intended multi-holder quorum.
**Insight:** When a quorum compares a numerator and denominator, verify both are computed with the same unit (count vs weighted quantity); mismatched metrics silently lower thresholds.