# Governance dust-vote budget capture

Slate or proposal selection that pays the best entry without an absolute minimum vote threshold

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2023-06-29. Updated 2026-11-02._

## How it works
Governance payout logic decides who gets paid by comparing proposals against each other, not against a floor. The broken assumption is that "the winning proposal" means "a proposal with real backing." When selection only requires a strictly greater vote sum than the current best, and per-proposal validation only rejects clearly invalid entries (negative votes), a proposal with dust or zero support can still be the best slate. If the payout then sends the *unallocated* remainder of a period budget to that slate, the dust winner is profitable [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md). The control assumes a threshold that the code never enforces.

## Where it shows up
- Slate/proposal selection that compares sums with `>` and never enforces a minimum vote count or funding threshold [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md).
- Per-proposal validation that only rejects negative values, so zero/dust entries pass [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md).
- Payout logic that sends the unallocated remainder to the winning slate, making a dust winner profitable [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md).
- Grant/funding distribution code where a self-transfer proposal can be a valid slate entry [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md).

## How to review
State the invariant and check it in code: a proposal may only be paid if its support meets an absolute minimum, independent of what it is compared against. Concretely:
- Does slate validation reject proposals below a minimum vote threshold, or only negative ones? [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md)
- Is the "better slate" test strictly greater, and can a dust proposal be the sole or best entry? [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md)
- Does the payout send the unallocated remainder to the winner, so a near-zero-vote slate still pays out? [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md)
- Can a proposal be a self-transfer or otherwise trivially satisfiable entry? [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md)

## How finders spotted it
- Read `_validateSlate` and the top-slate update together; noticed only negative `fundingVotesReceived` is rejected and improvement needs merely a greater sum, so dust-vote proposals can win [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md).

## Variants seen
- Dust-vote proposal capturing a period's unallocated budget, repeatable each period [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md).

## Impact and severity
Loss of the unallocated grant budget each period, scaling with automation across periods [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md). Impact rises because the theft is repeatable and cheap: the attacker needs only a dust vote share, and monitoring automation lets it recur every period [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md).

## Adjacent patterns (different root causes, not this one)
- Timelock admin setters guarded by a role instead of `msg.sender == address(this)`, letting the governor rewrite its own constraints [E2](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-01.md).
- Purchasable/borrowable voting power passing a treasury-draining `approve` proposal [E3](https://bugbountylibrary.com/r/dhl%3A20220214-buildf.md); how it was found is not stated in the evidence.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-01.md
- E3: https://bugbountylibrary.com/r/dhl%3A20220214-buildf.md