# PartyGovernanceNFT#rageQuit() can lead to token loss for users when dealing with zero-balance ERC20 during a rageQuit()

PartyGovernanceNFT.rageQuit skips minWithdrawAmounts check when token balance is zero, burning user voting tokens for no compensation.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: TresDelinquentes
- Disclosed: 2024-01-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-party-findings/issues/237
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-party%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** PartyGovernanceNFT.rageQuit()
**Root cause:** The minWithdrawAmounts check is nested inside `if (amount > 0)`, so when the party's ERC20 balance is zero, withdrawAmounts[i] is 0 and the minimum check is skipped entirely, yet voting tokens are still burned.
**Steps:**
1. Create a party with USDC holdings and mint voting tokens to Alice.
2. Transfer the entire USDC balance out via a proposal so party balance is 0.
3. Alice calls `rageQuit(tokenIds, [USDC], [1], alice)` with minWithdrawAmounts[0]=1.
4. Observe withdrawAmounts[0]=0, the `if (amount > 0)` block is skipped, no revert occurs.
5. Alice's voting tokens are burned via `_burnAndUpdateVotingPower`, totalVotingPower decreases, and she receives 0 USDC.
**How found:** Code reading of rageQuit's withdrawal loop: noticed the minWithdrawAmounts check is inside `if (amount > 0)`, so zero-balance tokens bypass the minimum check while tokens are still burned.
**Exploitation:** A user unaware of depleted token balance calls rageQuit with a nonzero minWithdrawAmounts; the function burns their voting tokens without transferring any tokens, causing loss of governance power and claim on party assets.
**Insight:** When auditing withdrawal/redemption functions, check whether minimum-output or slippage guards are nested inside amount>0 branches; zero-balance assets can silently bypass user-specified protections while still consuming shares.