# Signatures can be replayed in castVoteWithReasonAndParamsBySig() to use up more votes than a user intended

Governor vote-by-signature lacked a nonce, letting anyone replay a voter's signature to consume more votes than intended in Arbitrum security council elections.

- Payout: Contest reward
- Severity: high
- Program: Arbitrum Foundation
- Credited: MiloTruck
- Disclosed: 2023-09-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-arbitrum-findings/issues/252
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-arbitrum%3AH-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:governance vuln:signature-replay

**Target:** SecurityCouncilNomineeElectionGovernor / SecurityCouncilMemberElectionGovernor (OpenZeppelin GovernorUpgradeable)
**Root cause:** EXTENDED_BALLOT_TYPEHASH digest omits a nonce, so the same signature validates repeatedly; split-voting lets a partial vote be replayed until the voter's balance is exhausted.
**Steps:**
1. Bob signs EXTENDED_BALLOT_TYPEHASH digest for proposalId, support, reason, params allocating 500 of 1000 votes to contender A.
2. castVoteWithReasonAndParamsBySig() submits it; contender A gets 500 votes.
3. Attacker observes the signature in the tx and calls castVoteWithReasonAndParamsBySig() with the same v,r,s.
4. No nonce check, so it succeeds again, allocating another 500 votes to A.
5. Bob's second signature for contender B now reverts; all 1000 votes forced to A.
**How found:** Code-reading of OpenZeppelin GovernorUpgradeable's signature digest, noticing absence of nonce combined with the election spec's explicit allowance for splitting votes across candidates.
**Exploitation:** Attacker copies a victim's signed ballot from a public transaction and resubmits it verbatim to the governor, redirecting the victim's remaining voting power to a chosen nominee until balance is drained.
**Insight:** When a protocol permits partial/weighted voting, any signature-authorized action without a nonce becomes replayable to exhaust the signer's full weight; check EIP-712 digests for nonce and per-call uniqueness in governor-style contracts.