# High risk checks can be bypassed with extra `calldata` padding

Extra calldata padding on kernel executeAction calls bypasses _isHighRiskProposal length checks, letting high-risk governance proposals pass with lower quorum.

- Payout: Contest reward
- Severity: medium
- Program: Olympus On Chain Governance
- Credited: IllIllI
- Disclosed: 2024-01-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-olympus-on-chain-governance-judging/issues/100
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-olympus-on-chain-governance%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** GovernorBravoDelegate._isHighRiskProposal / propose
**Root cause:** _isHighRiskProposal uses strict equality (data.length == 0x44 / 0x40) to detect kernel executeAction calls; Solidity ignores trailing calldata bytes, so padded calldata still executes but fails the length check and is classified low-risk.
**Steps:**
1. Craft proposal calldata as `abi.encodeWithSelector(kernel.executeAction.selector, Actions.ActivatePolicy, address(custodian), "")` adding one extra empty byte beyond the 0x44 expected length.
2. Submit via governorBravoDelegator propose; _isHighRiskProposal sees data.length != 0x44 and != 0x40, hits `continue`, returns false.
3. propose() assigns getQuorumVotes() (200_000e18) instead of getHighRiskQuorumVotes() (300_000e18).
4. executeAction still executes correctly since Solidity ignores trailing calldata; proposal passes at lower quorum.
**How found:** Code review of the length-based classification logic; noticed Solidity ignores extra calldata bytes, so strict equality length checks can be evaded by padding.
**Exploitation:** Attacker submits a genuinely high-risk kernel executeAction proposal with one extra padding byte appended to calldata, so it is scored against the lower quorum threshold and can pass with fewer votes than the invariant requires.
**Insight:** When security classification depends on exact calldata length, remember ABI decoding tolerates trailing bytes—any strict `==` length gate can be bypassed by appending padding while the call still succeeds.