# PartyGovernanceNFT.sol#mint - User can delegate another users funds to themselves and brick them from changing the delegation

Attacker front-runs a victim's crowdfund contribution with a 1-wei contributeFor, pre-setting the victim's delegate to the attacker and capturing all their voting power.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: TresDelinquentes
- Disclosed: 2024-01-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-party-findings/issues/418
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-party%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** InitialETHCrowdfund.contributeFor / PartyGovernanceNFT.mint
**Root cause:** _processContribution lets any caller set delegationsByContributor[contributor] when oldDelegate==0, and mint unconditionally overwrites the caller-supplied delegate with delegationsByVoter[owner] without checking msg.sender==owner.
**Steps:**
1. Attacker calls `crowdfund.contributeFor{value:1}(0, payable(victim), attacker, "")` before victim's contribution, setting delegationsByContributor[victim]=attacker.
2. Victim calls `crowdfund.contribute{value:X}(victim, "")` with their own delegate.
3. In mint, `delegate_ = delegationsByVoter[owner]` is non-zero so delegate is forced to attacker.
4. All of victim's voting power is delegated to attacker via _adjustVotingPower.
**How found:** Reading the contributeFor -> _contribute -> _processContribution flow and noticing the oldDelegate==0 branch allows third-party delegate assignment, then tracing mint's unconditional delegate override.
**Exploitation:** Front-run the victim's contribution with a 1-wei contributeFor to lock in the attacker as delegate; victim's full contribution then delegates to attacker, granting attacker disproportionate voting power to pass/block proposals until victim re-delegates.
**Escalation:** Repeat across multiple contributors to accumulate enough voting power for a 51% governance attack.
**Insight:** When a mint/registration function accepts a delegate parameter but silently overrides it from stored state, check whether any other entrypoint can write that stored state on the victim's behalf before the victim's own call lands.