# Users can continue voting for inactive pools through registerVoteWeight()

registerAccountWeight() in Bima's IncentiveVoting skips the active-receiver check, letting users keep extending voting weight for deactivated receivers.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: 0xDjango
- Disclosed: 2025-02-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.18
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.18
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** IncentiveVoting.sol voting weight registration
**Root cause:** registerAccountWeight() re-adds existing votes via _addVoteWeights without calling _storeAccountVotes, which is the only place enforcing IBimaVault.isReceiverActive().
**Steps:**
1. Register a receiver and vote for it via `registerAccountWeightAndVote(user, 10, votes)` with MAX_POINTS.
2. Owner calls `bimaVault.setReceiverIsActive(RECEIVER_ID, false)`.
3. User locks more tokens and calls `incentiveVoting.registerAccountWeight(user, 10)`.
4. Observe `getReceiverWeightAt(RECEIVER_ID, week)` now extends weight from week 10 to week 15 despite inactive receiver.
**How found:** Code review comparing the three voting entrypoints: noticed registerAccountWeightAndVote() and vote() route through _storeAccountVotes (which checks isReceiverActive) while registerAccountWeight() re-adds existingVotes directly via _addVoteWeights, skipping the check.
**Exploitation:** A user who previously voted for a receiver that later gets deactivated calls registerAccountWeight() after locking more tokens; the stale vote is re-weighted with the new frozen weight, continuing to direct emissions to the inactive receiver.
**Insight:** When multiple entrypoints mutate the same state, diff which internal guard function each one calls; a 'vote unchanged' shortcut that skips the validation path is a classic bypass.