# Anyone can change approval/disapproval threshold for any action using LlamaRelativeQuorum strategy

LlamaRelativeQuorum.validateActionCreation is unpermissioned, letting anyone re-snapshot role supply and lower the approval threshold to pass a pending action.

- Payout: Contest reward
- Severity: high
- Program: Llama
- Credited: ktg
- Disclosed: 2023-07-26
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-06-llama-findings/issues/62
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-llama%3AH-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** LlamaRelativeQuorum strategy contract (validateActionCreation)
**Root cause:** validateActionCreation is external with no access control, so anyone can overwrite actionApprovalSupply/actionDisapprovalSupply snapshots after action creation, changing the quorum threshold.
**Steps:**
1. Deploy LlamaRelativeQuorum with minApprovalPct=10000 and 10 role holders.
2. Create an action; actionApprovalSupply[id]=10.
3. Approve with 9 holders; isActionApproved=false.
4. Executor revokes one policy holder (supply now 9).
5. Any address calls `validateActionCreation(actionInfo)`; actionApprovalSupply[id] becomes 9.
6. isActionApproved(actionInfo) now returns true.
**How found:** Code review of validateActionCreation noticed external visibility with no caller check, contradicting the documented intent of snapshotting supply at creation time.
**Exploitation:** Attacker waits until role supply drops below the snapshot, then calls validateActionCreation on a pending action to shrink the required approval count and force it into Approved state without the intended votes.
**Insight:** When a contract snapshots state 'at creation time' for quorum math, verify the snapshot function is gated to the core/creator; an unpermissioned re-snapshot lets supply changes retroactively alter thresholds.