# LockingPositionDelegate::manageOwnedAndDelegated unchecked duplicate tokenId allow metaGovernance manipulation

Duplicate tokenIds in manageOwnedAndDelegated inflate metaGovernance voting power, letting a delegatee seize up to 100% of a tokenId's delegation.

- Payout: Contest reward
- Severity: high
- Program: Convergence
- Credited: bughuntoor
- Disclosed: 2023-11-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-11-convergence-judging/issues/126
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-convergence%3AH-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** LockingPositionDelegate / LockingPositionService metaGovernance delegation
**Root cause:** manageOwnedAndDelegated loops over owned/mgDelegated/veDelegated arrays without deduplication, so the same tokenId can be processed repeatedly, and mgCvgVotingPowerPerAddress sums per-entry percentages.
**Steps:**
1. Bob delegates 10% metaGovernance of tokenId to Mallory, 90% to Alice.
2. Mallory calls `manageOwnedAndDelegated({owneds:[], mgDelegateds:[1,1,...x10], veDelegateds:[]})` adding tokenId 1 ten times at 10% each.
3. Call `mgCvgVotingPowerPerAddress(mallory)`; the loop sums 10x (balance*10%) yielding 100% of the tokenId's voting power.
4. Mallory now controls full metaGovernance weight for that tokenId, diluting Bob and Alice.
**How found:** Code review of manageOwnedAndDelegated loops and mgCvgVotingPowerPerAddress summation; noticed no duplicate/ordering check on input arrays, hypothesized repeated tokenId inflates the summed percentage.
**Exploitation:** Attacker with any delegated share of a tokenId repeatedly lists that tokenId in the mgDelegateds array; each duplicate re-adds the percentage in mgCvgVotingPowerPerAddress, multiplying voting power up to 100% and overriding other delegates.
**Escalation:** Repeating the tokenId N times scales voting power linearly, enabling full metaGovernance takeover of a tokenId from a small initial delegation.
**Insight:** When a view function sums per-entry percentages over a user-supplied array, check whether the same ID can appear twice; deduplication/ordering checks are the missing invariant.