# Governance quorum and vote manipulation

Can one actor reach quorum and pass a takeover proposal with little or no real opposition?

_Area: Smart contract access control and control flow. Seen in 32 disclosed reports; latest 2026-09-12. Updated 2026-10-22._

## How it works
Governance safety assumes passing a proposal requires broad, costly, and contested support. That assumption breaks when quorum is low relative to real turnout, when voting power is cheap to acquire or mint, or when a single holder can self-delegate past both the proposal threshold and quorum with no opposing votes. Once a proposal passes, the governor often controls a Timelock or ProxyAdmin, so one vote converts into full control of live contracts [E1](https://bugbountylibrary.com/r/dhl%3A20260912-yamfinance.md)[E3](https://bugbountylibrary.com/r/dhl%3A20260805-strongblock.md).

## Where it shows up
- GovernorAlpha/Compound-style forks: compare `quorumVotes()` and `proposalThreshold()` to actual delegate turnout [E1](https://bugbountylibrary.com/r/dhl%3A20260912-yamfinance.md).
- Opt-in vote wrappers over deposit shares where total wrapped supply is tiny versus TVL [E2](https://bugbountylibrary.com/r/dhl%3A20260823-termfinance.md).
- Governors that are the ProxyAdmin/Upgrader for live proxies, with vote weight mintable 1:1 from a cheaply purchasable token [E3](https://bugbountylibrary.com/r/dhl%3A20260805-strongblock.md).
- Voting power from historical snapshots, or proposals passable in one transaction [E6](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md).
- Numeric quorum args passed to OZ extensions where the denominator is 100, not what a comment claims [E8](https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AH-01.md).
- Mint functions callable through governance execution with no extra checks [E6](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md).

## How to review
The invariant: acquiring enough voting power to pass a proposal must cost more than the value the proposal can seize, and passing must require genuine contested support. Check quorum against realistic delegate turnout, not total supply. Check whether a single holder self-delegating clears threshold and quorum with zero against-votes [E1](https://bugbountylibrary.com/r/dhl%3A20260912-yamfinance.md). For wrapped or staked voting tokens, compare total voting supply to TVL; if wrapping is rare, a tiny deposit buys majority [E2](https://bugbountylibrary.com/r/dhl%3A20260823-termfinance.md). Confirm whether the governor is admin of a Timelock or ProxyAdmin over live contracts [E1](https://bugbountylibrary.com/r/dhl%3A20260912-yamfinance.md)[E3](https://bugbountylibrary.com/r/dhl%3A20260805-strongblock.md). Verify quorum denominator semantics directly in code, not comments [E8](https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AH-01.md).

## Variants seen
- Dormant DAO, low quorum, single self-delegating holder takes Timelock [E1](https://bugbountylibrary.com/r/dhl%3A20260912-yamfinance.md).
- Thin opt-in wrapped voting supply captured by one depositor [E2](https://bugbountylibrary.com/r/dhl%3A20260823-termfinance.md).
- Abandoned DAO, cheaply bought votes, governor seizes ProxyAdmin [E3](https://bugbountylibrary.com/r/dhl%3A20260805-strongblock.md).
- Majority chains two proposals to move minted claim tokens before distribution [E4](https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06.md).
- Historical snapshot balance passes a mint proposal in one transaction [E6](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md).
- Misread quorum fraction (4% vs 25%) [E8](https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AH-01.md).

## Why fixes fail
Comments claiming an intended quorum fraction did not match the actual denominator passed to the extension [E8](https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AH-01.md). Optional wrapping left voting supply near zero despite large TVL [E2](https://bugbountylibrary.com/r/dhl%3A20260823-termfinance.md).

## Impact and severity
Full protocol takeover and reserve drain: ~$121K [E1](https://bugbountylibrary.com/r/dhl%3A20260912-yamfinance.md), 2,841 WETH [E2](https://bugbountylibrary.com/r/dhl%3A20260823-termfinance.md), ~$72K [E3](https://bugbountylibrary.com/r/dhl%3A20260805-strongblock.md), 10B tokens dumped [E6](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md). Severity rises when the governor is proxy admin, vote weight is cheap, and turnout is dormant.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260912-yamfinance.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260823-termfinance.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260805-strongblock.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-06.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-20.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AH-01.md