# Executing funded standard proposals can be prevented by a proposal slate with duplicate proposals

Ajna StandardFunding.checkSlate accepts duplicate proposal ids, letting a top slate block a legitimate proposal from ever being executed/funded.

- Payout: Contest reward
- Severity: high
- Program: Ajna
- Credited: berndartmueller
- Disclosed: 2022-12-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/119
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-6
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** StandardFunding governance contract (checkSlate/executeStandard)
**Root cause:** checkSlate does not deduplicate proposalIds_, so the same proposal can be counted repeatedly to fill the 90% GBC budget, and _standardFundingVoteSucceeded only checks membership in the winning slate.
**Steps:**
1. Call `StandardFunding.checkSlate` with a slate containing the same proposal id repeated to maximize allocated budget up to `gbc * 9 / 10`.
2. Ensure this slate wins the funding vote so it becomes the funded slate.
3. A legitimate proposal not in the slate returns false from `_standardFundingVoteSucceeded` (membership check), so `GrantFund.state` is not Succeeded.
4. Calling `StandardFunding.executeStandard` on the legitimate proposal reverts; a correct slate cannot out-budget the malicious one.
**How found:** Code review of checkSlate loop: noticed no duplicate check while summing qvBudgetAllocated and tokensRequested, then traced _standardFundingVoteSucceeded membership logic to confirm execution blocking.
**Exploitation:** Attacker submits a duplicate-filled slate that maximizes budget allocation, wins the slate vote, and thereby prevents any proposal outside that slate from being executed during the distribution period.
**Insight:** When a slate/committee selection sums per-item budgets, check whether repeated ids inflate the total and whether the winning slate is compared by membership only—duplicates can lock out legitimate items.