# User can withdraw a lock without burning voting power when privatemode is disabled

When voting power token private mode is disabled, users transfer voting power out, withdraw stake without burning voting power, then transfer it back.

- Payout: Contest reward
- Severity: medium
- Program: Goat
- Credited: zigtur
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.2.10
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.10
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Controller.sol lockWithdraw voting power accounting
**Root cause:** Burn amount in lockWithdraw is computed from the user's current _dP2PDToken balance; if that balance is zero (transferred away) no voting power is burnt.
**Steps:**
1. Ensure voting power token private mode is disabled so transfers are enabled
2. Transfer entire _dP2PDToken voting power balance to a second account
3. Call `Controller.lockWithdraw` for the staked amount; burnt amount computes to zero since balance is 0
4. Transfer voting power tokens back to the original account
**How found:** Code reading of lockWithdraw burn calculation (Controller.sol#L579-L580) noticing burn depends on current _dP2PDToken balance, which is manipulable when private mode is off.
**Exploitation:** User moves voting power tokens to a second account, withdraws staked tokens via lockWithdraw so no voting power is burnt, then transfers voting power back, retaining full voting power while unstaking.
**Insight:** When a burn/slash amount is derived from a live token balance rather than a stored snapshot, check whether that balance can be moved out before the burn executes.