# If someone becomes a GSC member, they may become un-kickable forever

GSC member poisons voting-power history with thousands of delegate entries so kick()'s findAndClear loop runs out of gas, making them un-kickable.

- Payout: Audit contest
- Severity: medium
- Program: Arcade.xyz
- Found by: bart1e
- Disclosed: 2023-10-25
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2023-07-arcade#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-arcade%3AM-03
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:governance

**Target:** BaseVotingVault / GSCVault voting-power history
**Root cause:** queryVotePower calls History.findAndClear which iterates and deletes all stale entries; a user can create thousands of history entries via repeated delegate calls, so kick()'s queryVotePower exceeds block gas limit and reverts.
**Steps:**
1. Attacker stakes enough tokens in NFTBoostVault and calls `proveMembership([NFTBoostVault.address], ["0x"])` to join GSC.
2. Loop ~3500 times: `delegate(Alice)` then `delegate(Bob)` on NFTBoostVault to append many voting-power history entries across blocks.
3. Withdraw all staked tokens so voting power drops below threshold.
4. Victim calls `kick(Bob, ["0x"])`; queryVotePower -> findAndClear iterates thousands of entries and reverts OOG.
5. Attacker remains GSC member; repeat from another account to accumulate >50% of GSC.
**How found:** Reading proveMembership and kick, noticed both call queryVotePower which invokes findAndClear; realized history length is attacker-controlled via delegate calls and unbounded, so clearing cost can be made to exceed block gas limit.
**Exploitation:** Attacker gains GSC membership legitimately, inflates their own voting-power history with cheap delegate/redelegate dust transactions over thousands of blocks, then withdraws stake. Any kick attempt reverts out-of-gas because findAndClear must clear the bloated history, leaving the attacker permanently in the GSC and able to spend treasury tokens or push proposals.
**Escalation:** Repeat the attack from multiple funded accounts to reach >50% of GSC voting power, enabling treasury spend and proposal control; owner timelock may be too slow to veto.
**Insight:** When a view-like function mutates state by clearing history, check whether an attacker can inflate that history cheaply; unbounded per-user arrays iterated in a permissionless kick/cleanup path are a DoS vector.