# ETHCrowdfundBase.sol#_processContribution - Possible DoS on finalization of crowdfund under certain conditions

When maxTotalContributions equals minTotalContributions and exchangeRateBps<1e4, a 1-wei-short contribution forces votingPower rounding to 0, reverting finalization and locking the crowdfund.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: TresDelinquentes
- Disclosed: 2024-01-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-party-findings/issues/119
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-party%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:precision-loss

**Target:** ETHCrowdfundBase.sol _processContribution / finalize
**Root cause:** votingPower = (amount * exchangeRateBps)/1e4 rounds to 0 when the post-refund amount is 1 wei and exchangeRateBps<1e4, triggering ZeroVotingPowerError; the init check only rejects minTotalContributions > maxTotalContributions, allowing equality.
**Steps:**
1. Deploy crowdfund with minTotalContributions=10e18, maxTotalContributions=10e18, exchangeRateBps=0.5e4.
2. Alice contributes 5e18, Bob contributes 3e18.
3. Attacker front-runs with `contribute{value: 2e18-1}`, leaving totalContributions=10e18-1.
4. Alice's `contribute{value: 2e18}` refunds excess, amount=1, votingPower=(1*0.5e4)/1e4=0, reverts ZeroVotingPowerError.
5. Host `finalize()` reverts NotEnoughContributionsError since totalContributions<minTotalContributions.
**How found:** Reading _processContribution's votingPower==0 revert and the loose min>max init check, then reasoning about integer rounding when refund reduces amount to 1 wei.
**Exploitation:** Attacker front-runs the finalizing contribution with maxTotalContributions-1 wei total, forcing any subsequent contribution to refund down to 1 wei and revert on zero voting power; crowdfund cannot reach min goal until duration expires.
**Insight:** When a contract refunds excess before computing a derived value, check whether the residual amount can round a scaled value to zero and trip a zero-check revert; equality-allowed min/max bounds plus sub-1e4 rate enable this.