# CultureIndex.sol#dropTopVotedPiece() - Malicious user can manipulate topVotedPiece to DoS the whole CultureIndex and AuctionHouse

A piece can become top-voted without reaching its quorum, blocking dropTopVotedPiece and stalling CultureIndex/AuctionHouse auctions indefinitely.

- Payout: Contest reward
- Severity: medium
- Program: Collective
- Credited: deth
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/449
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:governance

**Target:** CultureIndex.sol dropTopVotedPiece / maxHeap voting
**Root cause:** dropTopVotedPiece requires the max-heap top piece to meet quorumVotes, but quorumVotes is cached at creation from total vote supply; a piece can be top-voted yet below quorum, and the heap cannot skip it.
**Steps:**
1. Call `ERC20TokenEmitter.buyToken` to inflate erc20VotingToken.totalSupply, raising quorumVotes for new pieces.
2. Create a bogus art piece via `cultureIndex.createPiece` so its cached quorumVotes is inflated.
3. Vote for the bogus piece via `cultureIndex.vote(pieceId)` so it becomes topVotedPieceId but totalVoteWeights < quorumVotes.
4. Call `cultureIndex.dropTopVotedPiece()` as dropperAdmin; it reverts on `totalVoteWeights[pieceId] >= quorumVotes`.
5. Bogus piece stays at heap max, blocking all lower-voted eligible pieces from being dropped/auctioned.
**How found:** Code reading of dropTopVotedPiece's quorum check against the max-heap extractMax, noticing quorumVotes is cached from total supply at creation and the heap cannot skip an unquorumed top piece.
**Exploitation:** Attacker buys non-transferable voting tokens, creates a fake piece with inflated quorum, and self-votes just enough to top the heap but not reach quorum, permanently blocking the drop/auction pipeline unless others outvote or vote the fake piece over quorum.
**Escalation:** Repeatedly re-creating fake pieces after being outvoted sustains the DoS; also occurs naturally when quorum is high and turnout low.
**Insight:** When a priority queue gates a permissioned action on a per-item threshold, check whether the max element can be ineligible yet unremovable — cached thresholds derived from mutable global supply make this reachable.