A secondary balance path skips the historical-snapshot guard used for voting power
- Severity
- High
- Class
- Access control
- System
- Vote-escrow governance token
Voting power can be acquired after the snapshot that was supposed to fix it, opening the door to a governance takeover.
Governance reads balances at a historical snapshot so that voting power can't be gathered after a proposal starts. One balance path — a renewal branch — computed its result without going through that snapshot guard, so it reported present-day power where past power was required.
That's enough to acquire influence after the cut-off the snapshot was meant to enforce.
Why it rated High
It undermines the fairness guarantee of snapshot voting and, against a live governor, could tip control of the protocol. Impact depends on an active consumer of the affected reading.
The fix class
Route every balance path, including renewals, through the same historical-snapshot logic.
