# Voting power inflation and capture

Duplicate ids, dust votes, or snapshot balances that inflate weight or capture unallocated budget

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-06-09. Updated 2026-10-24._

## How it works
Voting weight is supposed to count each unit of committed stake exactly once and only when a real threshold is met. That assumption breaks in three ways: the same id is summed repeatedly from a user-supplied array, a proposal wins on a near-zero vote because only a greater sum is required, or weight comes from a historical snapshot while a mint is reachable through governance execution, so one large holder passes a proposal in a single transaction.

## Where it shows up
- View functions that sum per-entry percentages over a user-supplied array with no dedup or ordering check [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-convergence%3AH-2.md)
- Slate or proposal validation that only rejects negative votes and compares slates by a strictly-greater sum [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md)
- Governance weight from a historical snapshot, with mint callable through governance execution and no extra checks [E1](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md)
- Any place a single holder or delegatee can pass a proposal in one transaction [E1](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md)

## How to review
State the invariant: total counted weight equals the sum over distinct ids of each id's committed stake, and no proposal wins without a real threshold. Then check:
- Are input arrays deduplicated and bounded before summation? [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-convergence%3AH-2.md)
- Does slate comparison require a minimum vote count, not just a greater sum? [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md)
- Can one address's snapshot balance alone pass a proposal, and is mint gated beyond governance execution? [E1](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md)

## Variants seen
- Duplicate tokenId in delegation arrays inflates metaGovernance power [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-convergence%3AH-2.md)
- Dust-vote proposal captures unallocated period budget [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md)
- Historical snapshot balance passes a mint-and-dump proposal [E1](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md)

## Impact and severity
High: up to 100% delegation seizure [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-convergence%3AH-2.md), loss of every period's unallocated budget [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md), and 10B token mint drained for 944 WETH [E1](https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md). E2 and E3 are cheap capture by any caller; E1 needs a large historical stake or majority, so severity there rises when a single transaction suffices and no threshold or timelock stands between vote and payout.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260609-topbpool.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-11-convergence%3AH-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AM-01.md