# Max magnitude lock check will lead to a DoS and possible monopolization of gov/Option on twTAP/TapiocaOptionBroker

twTAP/TapiocaOptionBroker max-magnitude check lets an attacker shrink pool.cumulative below 123455, DoSing new locks and monopolizing governance.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca DAO
- Credited: ronnyx2017
- Disclosed: 2024-05-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/98
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-20
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:governance

**Target:** twTAP.sol participate / TapiocaOptionBroker lock
**Root cause:** The check `magnitude >= pool.cumulative * 4` reverts when cumulative drops below ~123455; unlocking divergenceForce=false positions reduces cumulative, and a crafted divergenceForce=true position can push it under the threshold.
**Steps:**
1. User1 locks TAP with hasVotingPower=true for duration=1004800 (~11.6 days), raising cumulative to 1172777.
2. Before user1 unlocks, attacker (user2) locks TAP with hasVotingPower=true for duration=1172776 (~13.5 days), which subtracts from cumulative (averageMagnitude 526878), leaving cumulative=645899.
3. User1 unlocks; pool.cumulative -= user1.averageMagnitude (567977) => 77922, below 123455.
4. All further `participate` calls revert on `magnitude >= pool.cumulative * 4`, DoSing staking until attacker unlocks ~13.5 days later.
**How found:** Reading the participate magnitude check and solving the inequality for the minimum cumulative; realized divergenceForce=false unlocks decrease cumulative and crafted divergenceForce=true locks can drive it below threshold.
**Exploitation:** Attacker times a long-duration lock so that a prior participant's unlock subtracts enough from pool.cumulative to fall below 123455, blocking all new locks while attacker remains sole voter.
**Escalation:** During the DoS window attacker is the only governance voter, enabling monopolization of gov/Option.
**Insight:** When a contract enforces a ratio check against a running aggregate (cumulative), look for paths that decrease the aggregate (unlocks/withdrawals) and time a deposit so the decrease crosses the invariant's minimum.