# SALT staker can get extra voting power by simply unstaking their xSALT

Salty.IO quorum is computed from live total staked SALT, so a staker can unstake xSALT to lower quorum while keeping their cast vote, finalizing a ballot early.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: 0xpiken
- Disclosed: 2024-04-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/716
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-11
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** DAO Proposals/Staking contracts (Solidity)
**Root cause:** requiredQuorumForBallotType reads current totalStaked at finalization time instead of snapshotting quorum at proposal creation, so unstaking reduces the threshold while already-cast votes persist.
**Steps:**
1. Alice stakes SALT and calls `proposals.proposeParameterBallot(2, "description")` then `proposals.castVote(ballotID, Vote.INCREASE)`.
2. Warp past `daoConfig.ballotMinimumDuration()`; `proposals.canFinalizeBallot(ballotID)` returns false (votes < quorum).
3. Alice calls `staking.unstake(1110111 ether, 52)` reducing totalStaked.
4. `canFinalizeBallot(ballotID)` now returns true because requiredQuorum dropped below totalVotesCastForBallot.
5. Alice calls `DAO#finalizeBallot()`; then cancels unstaking with no loss.
**How found:** Code reading of canFinalizeBallot/requiredQuorumForBallotType: noticed quorum depends on live totalShares rather than a snapshot, and that unstaking doesn't remove prior votes.
**Exploitation:** Attacker with a large stake votes, waits for minimum duration, unstakes to shrink totalStaked and thus the quorum denominator, finalizes the ballot, then cancels the unstake to restore stake with no penalty.
**Escalation:** Judge notes colluding voters can effectively reduce quorum to quorum/(1+quorum), letting a minority pass proposals.
**Insight:** When a threshold is derived from a mutable global (total staked/supply) at check time, test whether an actor can move that global between casting a weight and the check — snapshot thresholds at proposal creation.