# Vote weight moved from wrong account

Vote debit/credit paths using owner or zero address instead of the actual delegate

_Area: Smart contract access control and control flow. Seen in 4 disclosed reports; latest 2023-10-17. Updated 2026-10-24._

## How it works
Delegated voting tracks weight per delegate, not per token holder. The invariant is that every credit and debit of vote weight names the same account: the delegate who actually holds the weight. The pattern breaks when a move path debits a different account than the one credited — the token owner instead of `delegates(owner)`, the zero address instead of the real previous delegate, or a delegate who never received the weight. The subtraction then hits a balance that does not exist, either underflowing or silently removing weight from someone else's tally.

## Where it shows up
- `_afterTokenTransfer` / `_moveDelegateVotes` call sites passing `_from`/`_to` rather than `delegates(_from)`/`delegates(_to)` [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-02.md)
- Unchecked subtraction of `balanceOf(account)` or a fixed `1` where the checkpoint may be zero [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-02.md)
- Delegation mapping read directly, defaulting to `address(0)`, where `from == 0` is treated as a mint (credit without debit) [E4](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-04.md)
- Override/withdrawal logic subtracting a delegator's weight from a delegate's tally without confirming that delegate ever accumulated delegated weight [E1](https://bugbountylibrary.com/r/c4%3A2023-08-livepeer%3AH-02.md)
- Asymmetry between how weight is credited (only certain roles accumulate) and how it is debited [E1](https://bugbountylibrary.com/r/c4%3A2023-08-livepeer%3AH-02.md)

## How to review
For every vote move, trace both sides: the account debited must equal the account credited, and must be the delegate holding the weight. Check that `delegates(account)` is used, not the raw account. Check that default mapping values cannot collide with the mint/burn sentinel (`address(0)`). Check that subtraction operands are guaranteed non-zero and that unchecked blocks are justified. For override paths, confirm the debit target is exactly the set of accounts that could have received the credit.

## Variants seen
- Transfer moves votes between owners instead of delegates, underflowing unchecked arithmetic [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-01.md)
- Same mismatch makes transfers and burns revert after delegation, freezing tokens [E3](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-02.md)
- First self-delegation credits without debiting because previous delegate defaults to zero [E4](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-04.md)
- Override subtracts weight from a non-transcoder delegate who never received it [E1](https://bugbountylibrary.com/r/c4%3A2023-08-livepeer%3AH-02.md)

## Impact and severity
Outcomes ranged from unlimited voting power [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-01.md) and doubled weight [E4](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-04.md) to frozen NFTs [E3](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-02.md) and governance tally manipulation [E1](https://bugbountylibrary.com/r/c4%3A2023-08-livepeer%3AH-02.md). Severity is high: silent inflation of governance power or permanent lockup. Unchecked arithmetic and zero-sentinel defaults made it worse.

## Why fixes fail
Fixes that patch one call site leave the same owner-vs-delegate mismatch elsewhere; the invariant must hold at every move path [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-02.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-08-livepeer%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-02.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AH-04.md