# Votes deducted from wrong account

Third-party calls and zero-address delegation that mutate vote checkpoints keyed off msg.sender instead of the resolved owner

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2022-11-03. Updated 2026-10-23._

## How it works
Vote and balance accounting assumes the caller is the account whose votes change. When a function accepts third-party callers (approvals, delegates) or special-cases address(0), the code adjusts `votes[msg.sender]` or a total instead of the resolved token owner. The subtraction and addition land on different accounts, so checkpoints drift from reality and later operations underflow or revert.

## Where it shows up
- Unstake/transfer/burn paths that read `msg.sender` for vote deltas while the token owner is resolved separately.
- `delegate`/`delegateBySig` accepting `address(0)` as destination.
- `_moveDelegateVotes`-style helpers that subtract from one side and add to another without symmetry.
- Totals adjusted on identity transitions (self vs other) without checking the balance crossed zero.
- Loops removing accumulated `lostVotingPower` from the caller's record.

## How to review
For every state mutation, confirm the account keyed is the resolved owner, not the caller. Check that any subtract has a matching add on the same or intended account, and that address(0) is rejected or handled symmetrically. For delegate/undelegate, verify the branch fires only when the balance actually crosses zero. Invariant: sum of per-account votes equals the tracked total, and no account's votes go negative.

## Variants seen
- Approved third party unstakes; votes deducted from caller, trapping the NFT [E1](https://bugbountylibrary.com/r/sherlock%3A2022-11-frankendao%3AH-4.md).
- Owner delegates to address(0); votes zeroed, later transfer/burn underflows and reverts, locking the NFT [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-07.md).
- Delegate/undelegate updates total community voting power without checking zero-crossing, drifting totals [E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-frankendao%3AH-1.md).

## Impact and severity
Governance accounting corruption and locked NFTs. Severity rises when the drift is permanent (locked token) or silently skews totals used for quorum and delegation weight.

## Why fixes fail
Branch conditions based on identity (self vs other) rather than actual balance state leave round-trips able to re-drift totals [E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-frankendao%3AH-1.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2022-11-frankendao%3AH-4.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-07.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2022-11-frankendao%3AH-1.md