> For the complete documentation index, see [llms.txt](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/smart-contracts-security/code4rena/high-risk-findings/anyone-can-pass-any-proposal.md).

# Anyone Can Pass Any Proposal

### Summary:

<https://code4rena.com/reports/2022-08-olympus#h-01-in-governancesol-it-might-be-impossible-to-activate-a-new-proposal-forever-after-failed-to-execute-the-previous-active-proposal>

Before any `VOTES` are minted anyone can activate and execute an arbitrary proposal even with 0 votes cast. So an attacker can pass any proposal (i.e. change the `executor` + `admin` of the `Kernel`, gaining access to all permissioned functions and to funds held).

### Mitigation:

In `Governance.sol` check for a minimum VOTES totalSupply.

### TAGS: #proposals