# Single host can unfairly skip veto period for proposal that does not have full host support

A single host can abdicate host status to an alt wallet and re-accept a proposal, faking full host support to skip the veto period.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: Madalad
- Disclosed: 2024-01-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-party-findings/issues/233
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-party%3AH-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** PartyGovernance governance contract (accept/abdicateHost)
**Root cause:** accept() checks current isHost[msg.sender] rather than host status at proposal time, and abdicateHost can be called at any proposal lifecycle stage, so one host can cycle host status across controlled wallets to inflate numHostsAccepted.
**Steps:**
1. Create party with two hosts (alice, bob) and mint gov NFTs including aliceAltWallet with 1 voting power.
2. alice makes a proposal; chad votes to reach pass threshold; bob does not accept, so status is Passed (veto period active).
3. alice calls `party.abdicateHost(address(aliceAltWallet))` transferring host status to her alt wallet.
4. aliceAltWallet calls `vote(party, proposalId, 0)` which increments numHostsAccepted to 2.
5. getProposalStateInfo now returns Ready, skipping the veto period despite bob never accepting.
**How found:** Code review of abdicateHost noting it is callable at any proposal stage and that accept() uses live isHost state rather than a snapshot, unlike votingPower which is snapshotted.
**Exploitation:** A malicious or compromised host accepts a harmful proposal, abdicates host status to a controlled wallet with nonzero voting power, and re-accepts, repeating until numHostsAccepted equals numHosts. The veto period is skipped and the malicious proposal (e.g. Tornado-Cash-style hidden CREATE2/SELFDESTRUCT payload) executes before honest hosts can veto.
**Escalation:** Chains with a deceptive proposal payload to pass vote threshold and execute immediately, enabling theft of party assets (~$1M Tornado Cash precedent cited).
**Insight:** When governance tracks per-actor counters (host accepts, approvals) using live role state, check whether role transfer/renouncement lets one actor re-count; compare against how voting power is snapshotted at proposedTime-1.