# User Can Vote Even When They Have 0 Locked Mento (Edge Case)

When Locking is stopped, withdraw() returns the full locked amount without clearing veMENTO lines, so a user who withdrew everything still votes.

- Payout: Contest reward
- Severity: medium
- Program: Mento
- Credited: ComposableSecurity
- Disclosed: 2024-02-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-mento-judging/issues/14
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-mento%3AM-1
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** Locking.sol / Governance veMENTO voting power
**Root cause:** getAvailableForWithdraw returns the entire locked amount when stopped, but withdraw() does not remove the account's locked lines, so veMENTO voting power persists after full withdrawal.
**Steps:**
1. Alice locks 10_000e18 MENTO via `locking.lock(alice, alice, 10_000e18, 1, 103)` and a proposal is created.
2. Owner calls `locking.stop()`.
3. Alice calls `locking.withdraw()`; getAvailableForWithdraw returns full amount since `stopped` skips bias subtraction, and she receives all MENTO.
4. Owner calls `locking.start()`.
5. Alice calls `mentoGovernor.castVote(proposalId, 1)` and the vote succeeds despite zero locked balance.
**How found:** Code reading of getAvailableForWithdraw's `if (!stopped)` branch, noticing the stopped path returns the full amount while withdraw() never adjusts the locked lines; confirmed with a Foundry PoC in GovernanceIntegration.t.sol.
**Exploitation:** Requires the contract owner to pause Locking; during the pause window a user withdraws their full locked MENTO, then after unpause their delegate still casts votes with the stale veMENTO power.
**Insight:** Pause/emergency branches that bypass time-decay math often skip state cleanup; check whether withdraw paths under `stopped`/paused flags still decrement the accounting (lines/bias/slope) that grants voting or reward power.