# Gov (twTAP) and Tapioca Option can be monopolized by an attacker

twTAP._releaseTap fails to update averageMagnitude on exit, letting an attacker inflate it until cumulative resets to zero, monopolizing governance.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca DAO
- Credited: ronnyx2017
- Disclosed: 2024-05-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/97
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-21
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** twTAP governance and TapiocaOptionBroker staking contracts
**Root cause:** _releaseTap decrements totalParticipants but never updates averageMagnitude, so the average only ever grows; on exit, if cumulative < averageMagnitude, cumulative is reset to 0.
**Steps:**
1. Create a twTAP position with `divergenceForce = true` and `magnitude = M1 = current pool.averageMagnitude`; participation raises averageMagnitude by M1.
2. Wait for unlock and exit; averageMagnitude stays inflated while totalParticipants returns to 0.
3. Repeat to grow averageMagnitude by M1 each cycle.
4. Before final unlock, join with `divergenceForce = false` for a couple months.
5. Exit the last position with `divergenceForce = true` so `pool.cumulative = 0`, blocking others from participating.
**How found:** Code reading of _releaseTap noticed totalParticipants updated but averageMagnitude not, and the TODO comment doubting cumulative < averageMagnitude hinted the branch was reachable.
**Exploitation:** Attacker cycles join/exit positions to inflate pool.averageMagnitude, then forces pool.cumulative to zero on exit, making multiplier/target collapse to dMIN and locking out other participants from twTAP governance.
**Escalation:** Repeated join/exit cycles make the attack progressively easier and can even trigger unintentionally; same flaw exists in TapiocaOptionBroker.
**Insight:** When a pool tracks an average alongside a participant count, check every add/remove path updates both; a stale average combined with a clamp-to-zero branch can be weaponized to zero out cumulative state.