# Fully slashed transcoder can vote with 0 weight messing up the voting calculations

A fully slashed transcoder retains delegateAddress and votes with 0 weight, causing delegator vote overrides to subtract from other voters' weight and potentially revert.

- Payout: Contest reward
- Severity: medium
- Program: Livepeer
- Credited: Vagner ([1](https://github.com/code-423n4/2023-08-livepeer-findings/issues/194)
- Disclosed: 2023-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-livepeer-findings/issues/194
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-livepeer%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** BondingManager/BondingVotes/GovernorCountingOverridable governance contracts
**Root cause:** slashTranscoder zeroes bondedAmount but leaves delegateAddress set, so getPastVotes returns 0 while _handleVoteOverrides still treats the address as a transcoder and subtracts delegator weight from the transcoder's recorded (zero) vote.
**Steps:**
1. Fully slash a transcoder via `slashTranscoder` so `bondedAmount` becomes 0 but `delegateAddress` remains set.
2. Transcoder calls `castVote`; `getPastVotes` returns 0 because `bondedAmount == 0`, so `_countVote` records a 0-weight vote.
3. A delegator who delegated to that transcoder calls `castVote` with overridden weight; `_handleVoteOverrides` sees the transcoder already voted and subtracts the delegator's weight from the transcoder's support tally.
4. Because the transcoder's tally is 0, the subtraction underflows/reverts or is taken from other voters' weight, blocking the delegator's override.
**How found:** Code reading of slashTranscoder showed delegateAddress is never cleared on full slash; tracing getPastVotes and _handleVoteOverrides revealed the mismatch between 0 vote weight and the transcoder's bondedAmount used in override subtraction.
**Exploitation:** Requires slashing enabled (deprecated in protocol). A slashed transcoder votes 0 weight in a low-support category (e.g. abstain); delegators attempting to override their vote then hit subtraction against zero weight, reverting and forcing them out of governance until they redelegate.
**Insight:** When a slash/reset zeroes a stake field, check every other field (delegate pointer, role flags) that gates privilege elsewhere; a zeroed balance with a stale role can still pass role checks and corrupt accounting that assumes vote weight equals recorded stake.