# The 51% majority can hijack the party's precious tokens through an arbitrary call proposal if the AddPartyCardsAuthority contract is added as an authority in the party.

ArbitraryCallsProposal lacked a check blocking calls to AddPartyCardsAuthority, letting a 51% majority mint a puppet with huge voting power and drain precious NFTs.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: sin1st3r\_\_
- Disclosed: 2024-01-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-party-findings/issues/533
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-party%3AH-01
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Party governance ArbitraryCallsProposal / AddPartyCardsAuthority
**Root cause:** ArbitraryCallsProposal._isCallAllowed does not forbid calls to the AddPartyCardsAuthority contract, so a majority can mint a new member with astronomical voting power and then pass a 'unanimous' proposal to transfer precious tokens.
**Steps:**
1. Party has AddPartyCardsAuthority added as an authority.
2. Majority creates ArbitraryCallsProposal calling `addPartyCards([attacker],[7922816251426433759354395],[address(0)])`; 51% accept and execute.
3. Attacker now holds voting power >= total, so their proposals are marked unanimous.
4. Attacker proposes ArbitraryCallsProposal with `IERC721.transferFrom(party, attacker, tokenId)` for each precious token.
5. Attacker alone votes; proposal is unanimous, bypassing precious-token safeguards and execution delay; execute transfers NFTs out.
**How found:** Code review of ArbitraryCallsProposal._isCallAllowed found no blocklist for the AddPartyCardsAuthority target/selector, combined with understanding that unanimity bypasses precious-token safeguards.
**Exploitation:** 51% of voting power passes an arbitrary call minting a puppet member with voting power equal to total supply; the puppet then passes a self-voted 'unanimous' arbitrary-call proposal transferring all precious NFTs to the attacker, bypassing the 100%-quorum precious-token guardrail.
**Escalation:** Two-stage: mint puppet voting power via authority call, then use puppet's unanimity to bypass precious-token transfer restrictions.
**Insight:** When a protocol enforces a '100% unanimous' bypass for sensitive actions, look for any in-scope call path (authority minting, delegation, voting-power grants) that a simple majority can invoke to manufacture unanimity and defeat the guardrail.