# Adversary can win proposals with voting power as low as 4%

TokenGovernor passed 4 to GovernorVotesQuorumFraction, setting quorum to 4% instead of intended 25%, letting an attacker pass malicious proposals with 4% voting power.

- Payout: Contest reward
- Severity: high
- Program: IQ AI
- Credited: juancito
- Disclosed: 2025-03-19
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-iq-ai#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:governance

**Target:** TokenGovernor governance contract (Solidity/OpenZeppelin Governor)
**Root cause:** Constructor passes GovernorVotesQuorumFraction(4), which OpenZeppelin interprets as numerator over denominator 100 (4%), not 1/4 (25%) as the comment claims.
**Steps:**
1. Read TokenGovernor.sol L55: `GovernorVotesQuorumFraction(4)` with comment claiming 25%
2. Confirm OZ quorumDenominator()=100 and quorum = supply*numerator/denominator
3. Attacker acquires 4% of supply, calls `token.delegate(attacker)`
4. Call `governor.propose(targets, values, calldatas, description)` with malicious target
5. Warp past votingDelay, `governor.castVote(nonce, 1)`
6. Warp past votingPeriod, `governor.execute(...)` — succeeds with 4% votes vs 25% expected
**How found:** Code reading of the constructor against the inline comment claiming 25% quorum; cross-checked OpenZeppelin GovernorVotesQuorumFraction semantics (numerator/100) to confirm the mismatch.
**Exploitation:** Attacker accumulates 4% of token supply (feasible on low-cap Fraxtal agent tokens), self-delegates, proposes arbitrary malicious calldata, votes, and executes once quorum of 4% is met, bypassing the intended 25% threshold.
**Insight:** When a constructor passes a numeric arg to an OZ Governor extension, verify the denominator semantics (quorumDenominator defaults to 100, not 4) rather than trusting the inline comment; comments claiming fractions like '1/4th' are a red flag for numerator/denominator confusion.