# The quorumVotes can be bypassed

CultureIndex snapshots quorumVotes from token supply at createPiece time, so buying tokens in the same block understates quorum and lets under-voted art pieces be dropped.

- Payout: Contest reward
- Severity: medium
- Program: Collective
- Credited: ast3ros
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/409
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:governance

**Target:** CultureIndex.createPiece / dropTopVotedPiece quorum logic
**Root cause:** quorumVotes is computed and stored from erc20/erc721 totalSupply at piece creation, but VotesUpgradeable uses block-number clock, so supply changes later in the same block are not reflected, understating quorum.
**Steps:**
1. Call `createPiece(metadata, creatorArray)` in block N; `newPiece.totalVotesSupply = _calculateVoteWeight(erc20VotingToken.totalSupply(), erc721VotingToken.totalSupply())` and `quorumVotes = quorumVotesBPS * totalVotesSupply / 10_000` are stored.
2. In the same block N, back-run with `erc20TokenEmitter.buyToken{value: 100 ether}(recipients, bps, rewards)` to mint voting tokens.
3. Observe stored `quorumVotes` remains based on pre-purchase supply (POC shows quorumVotes 0 while live `cultureIndex.quorumVotes()` is ~1.94e18).
4. Vote on the piece with the newly acquired tokens and call `dropTopVotedPiece()`; the low stored quorum is met despite real supply being higher.
**How found:** Noticed quorumVotes is snapshotted at creation from totalSupply while vote checkpoints use block-number clock, meaning same-block supply increases are invisible to the stored quorum; confirmed with a Foundry POC showing quorumVotes 0 vs live quorum ~1.94e18.
**Exploitation:** Attacker back-runs createPiece in the same block, buys governance tokens, votes for the piece, and drops it with far fewer votes than the protocol's intended quorum, minting and auctioning an art piece that never legitimately met quorum.
**Insight:** When a contract snapshots a supply-derived threshold at creation but the underlying token uses block-number checkpoints, same-block mints/purchases are invisible to the snapshot; check whether the threshold should be recomputed via getPastTotalSupply at enforcement time.