# Governance wrongly calculates _quorumReached()

LybraGovernance._quorumReached sums against+abstain votes instead of total votes, so quorum only passes when a third of votes oppose or abstain.

- Payout: Contest reward
- Severity: high
- Program: Lybra Finance
- Credited: T1MOH
- Disclosed: 2023-08-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-lybra-findings/issues/14
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AH-08
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** LybraGovernance.sol governance contract (_quorumReached)
**Root cause:** _quorumReached uses supportVotes[1] + supportVotes[2] (against + abstain) instead of totalVotes, so quorum is measured on the wrong vote bucket.
**Steps:**
1. Read `_quorumReached`: `return proposalData[proposalId].supportVotes[1] + proposalData[proposalId].supportVotes[2] >= quorum(...)`
2. Cross-check `proposals()` mapping: supportVotes[0]=for, [1]=against, [2]=abstain
3. Observe quorum only reached when against+abstain >= quorum threshold, ignoring for-votes
4. Fix: use `proposalData[proposalId].totalVotes >= quorum(...)`
**How found:** Manual code review of the governance contract; noticed the quorum check referenced supportVotes indices 1 and 2, then verified against the proposals() getter that those indices are against and abstain rather than total.
**Exploitation:** A proposal with overwhelming for-votes but few against/abstain votes fails quorum; conversely a minority can block or manipulate governance outcomes by voting against/abstain to satisfy the miscounted quorum.
**Insight:** When auditing governance forks (e.g. OZ Governor derivatives), verify each vote-bucket index against the getter that names them; quorum and proposal-state functions often reference the wrong supportVotes slot after refactors.