# Dust vote on one pool prevents poke()

Dust 1-wei vote on a second pool rounds to zero after ve decay, making poke() revert with ZV and freezing stale full voting weight.

- Payout: Contest reward
- Severity: medium
- Program: Hybra Finance
- Credited: Huntoor
- Disclosed: 2025-11-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-10-hybra-finance#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-04
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** VoterV3.poke() in ve(3,3) voting contract
**Root cause:** poke() requires every pool's recomputed _poolWeight != 0; a 1-wei vote times decayed weight divided by totalVoteWeight rounds down to 0, reverting the whole loop.
**Steps:**
1. Create veNFT lock and two gauges/pools.
2. Call `voter.vote(tokenId, [pair0,pair1], [1e16-1, 1])` placing a 1-wei dust vote on pair1.
3. Advance time so balanceOfNFT decays (`vm.warp(block.timestamp+3)`).
4. Call `voter.poke(tokenId)`; loop hits dust pool, `_poolWeight` rounds to 0, reverts `ZV`.
5. Victim's stale pre-decay weight stays applied to voted pools indefinitely.
**How found:** Reasoned about ve(3,3) poke invariant and weight decay, then noticed the `require(_poolWeight != 0)` guard would trip on a dust vote once decay makes the product round to zero.
**Exploitation:** Attacker votes near-full weight on target pool plus 1 wei on a second pool, then goes inactive; anyone attempting poke() via ve deposit/increase reverts, so the attacker keeps full undecayed voting weight and inflated gauge/bribe share without permanent lock.
**Escalation:** At scale, many veNFTs made unpokable preserve full weight, skewing emissions and bribe distribution across pools.
**Insight:** In ve(3,3) forks, per-pool loop guards that revert on zero weight turn any dust allocation into a global DoS of poke/abstain; test rounding-to-zero paths after decay, not just at vote time.