# By delegating to a non-transcoder, a delegator can reduce the tally of someone else's vote choice without first granting them any voting power

Delegating to a non-transcoder delegate lets a delegator subtract their weight from that delegate's already-cast vote tally, double-counting governance power.

- Payout: Contest reward
- Severity: high
- Program: Livepeer
- Credited: Banditx0x
- Disclosed: 2023-10-17
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-livepeer-findings/issues/96
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-livepeer%3AH-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:governance

**Target:** Livepeer protocol governance voting contract (_handleVotesOverrides)
**Root cause:** The override logic subtracts a delegator's weight from the delegate's vote tally whenever the delegate has voted, without checking the delegate is a transcoder who actually received that weight.
**Steps:**
1. Alice (non-transcoder delegate) has 100 votes and votes For; For tally += 100.
2. Bob delegates 1000 votes to Alice; Alice's tally is not increased since she is not a transcoder.
3. Bob votes Against; `_handleVotesOverrides` sees delegateVoter.hasVoted and subtracts Bob's `_weight` (1000) from the For tally.
4. Net: For reduced by 900, Against +1000, inflating Bob's effective governance power.
**How found:** Code reading of the vote weight calculation: noticed non-transcoders get weight from `delegatorCumulativeStakeAt` and never gain delegated weight, then spotted the missing isTranscoder check in the `delegateVoter.hasVoted` subtraction branch.
**Exploitation:** Attacker delegates weight to a non-transcoder delegate who has voted or will vote for an opposing choice, then votes themselves; the override subtracts their weight from the victim's tally while adding it to their own choice, effectively doubling voting power.
**Insight:** In delegation-based governance, audit the asymmetry between how weight is credited (only transcoders accumulate delegatedAmount) and how it is debited on override; any subtraction path lacking the same role check as the credit path enables tally manipulation.