# `QVBaseStrategy::reviewRecipients()` doesn't check if the recipient is already accepted or rejected, and overwrites the current status

QVBaseStrategy.reviewRecipients overwrites recipient status once any status hits reviewThreshold, so 2 late accepts flip a recipient rejected by 3 managers.

- Payout: Contest reward
- Severity: medium
- Program: Gitcoin
- Credited: 0x00ffDa
- Disclosed: 2023-09-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-Gitcoin-judging/issues/699
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-12
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** QVBaseStrategy.sol reviewRecipients() in allo-v2 QV strategy contracts
**Root cause:** reviewRecipients increments reviewsByStatus[recipientId][status] and sets recipient.recipientStatus as soon as that status count reaches reviewThreshold, without checking the recipient's existing status or comparing competing status counts.
**Steps:**
1. Deploy QV strategy with 5 pool managers and reviewThreshold=2.
2. Register a recipient via __register_recipient().
3. pool_manager1/2/3 each call `reviewRecipients([recipientId],[Rejected])` -> status becomes Rejected with 3 reject votes.
4. pool_admin and pool_manager4 call `reviewRecipients([recipientId],[Accepted])` -> Accepted count hits 2 >= threshold.
5. Assert getRecipientStatus == Accepted despite 3 Rejected vs 2 Accepted.
**How found:** Code reading of reviewRecipients: noticed the threshold check only compares the incoming status's own counter and never inspects recipient.recipientStatus or the opposing counter, then constructed a multi-manager voting scenario to demonstrate the overwrite.
**Exploitation:** A minority of pool managers (2 of 5) can flip a recipient's status to Accepted after a majority (3) rejected it, by voting last once the Accepted counter reaches the threshold; the status write is unconditional on prior state.
**Insight:** In multi-signer/threshold voting contracts, check whether the tally for one outcome can reach threshold after the opposite outcome already finalized; the last voters to cross threshold can silently reverse a decided result unless finalization is terminal.