# Proposal vote power can be easily manipulated

ArcadeGSCCoreVoting snapshots vote power at block.number-1, so a single-block loan can inflate voting power and pass arbitrary proposals.

- Payout: Audit contest
- Severity: medium
- Program: Arcade.xyz
- Found by: DadeKuma
- Disclosed: 2023-10-25
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-07-arcade#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-arcade%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:governance

**Target:** ArcadeGSCCoreVoting / CoreVoting governance contract
**Root cause:** Proposal creation records created = block.number - 1 and queryVotePower reads token balance at that single block, so vote power is a one-block snapshot rather than a time-weighted average.
**Steps:**
1. Attacker takes a large (even undercollateralized) loan of the governance token for one block.
2. Attacker calls propose() so the proposal's created field is set to `uint128(block.number - 1)`.
3. Attacker votes; CoreVoting loops approved vaults calling `IVotingVault(votingVaults[i]).queryVotePower(msg.sender, proposals[proposalId].created, extraVaultData[i])`, reading the inflated balance.
4. With majority voting power the attacker passes and executes an arbitrary proposal.
**How found:** Code review of CoreVoting's proposal creation noting the `block.number - 1` flash-loan mitigation comment, then tracing queryVotePower to see it reads a single-block snapshot; checked GSCVault to see whether vote power depends on token balance.
**Exploitation:** Borrow governance tokens for a single block, create a proposal (snapshot at block.number-1), vote with the borrowed balance, then repay after the block; only one block of slippage/risk is exposed.
**Escalation:** Arbitrary proposal execution if an approved vault's queryVotePower depends on token holdings (e.g. LockingVault); currently limited because only GSCVault is intended.
**Insight:** When a governance contract snapshots vote power at a single block to 'mitigate flash loans', check whether a normal multi-block or single-block loan still suffices; also check whether approved voting vaults are mutable, since a token-balance vault added later reopens the attack.