# Eligibility of cancelled proposals makes it possible for `proposalEligibilityQuorumBps` controlling actor to create multiple eligible proposals, stealing rewards from all others

Cancelled proposals still count as eligible for rewards, letting a 10%+ holder spam create-vote-cancel cycles to steal proposal rewards from honest participants.

- Payout: Contest reward
- Severity: high
- Program: Nouns Dao 2
- Credited: hyh
- Disclosed: 2024-03-03
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-03-nouns-dao-2-judging/issues/51
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Rewards.sol and NounsDAOProposals.sol governance contracts
**Root cause:** proposalDataForRewards() includes cancelled proposals in the eligible set as long as forVotes meets the quorum threshold, and cancel() allows early cancellation after voting starts, enabling rapid create-vote-cancel cycles.
**Steps:**
1. Acquire >10% of totalSupply votes (proposalEligibilityQuorumBps).
2. Create a proposal with clientId approved.
3. Wait for proposalUpdatablePeriodInBlocks + votingDelay, then vote for it to reach quorum.
4. Call cancel() as proposer to set canceled=true.
5. Immediately create a new proposal (checkNoActiveProp passes since state is Canceled).
6. Repeat create-vote-cancel to generate many eligible proposals.
7. Call updateRewardsForProposalWritingAndVoting(); cancelled proposals are counted, diluting rewards for honest proposals.
**How found:** Code review of Rewards.sol's proposalDataForRewards() revealed it only checks forVotes against quorum and does not filter canceled proposals; cross-referencing cancel() and checkNoActiveProp() showed early cancellation enables rapid iteration.
**Exploitation:** An actor controlling >10% of supply repeatedly creates proposals, votes them to quorum, and cancels them before the full voting period ends, generating eligible proposals much faster than the normal lifecycle. These cancelled proposals are counted in rewards calculation, stealing a large share of proposal rewards from other clientId owners.
**Escalation:** Can be intermixed with legitimate proposals to conceal manipulation and gradually increase share without raising red flags.
**Insight:** When auditing reward distribution logic, check whether proposals in non-final states (canceled, vetoed) are excluded; early-cancellation mechanisms can be abused to spam eligible proposals if rewards count them.