# (Mis) Configuring pallet-elections-phragmen

**URL:** <https://forum.polkadot.network/t/mis-configuring-pallet-elections-phragmen/2502>\
**Category:** Ecosystem\
**Tags:** security\
**Created:** [April 3, 2023, 6:21pm UTC](https://forum.polkadot.network/t/mis-configuring-pallet-elections-phragmen/2502 "2023-04-03T18:21:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![VinceCorsica](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/vincecorsica/32/6543_2.png) [@VinceCorsica](https://forum.polkadot.network/u/VinceCorsica)\
**Post date:** [April 3, 2023, 6:21pm UTC](https://forum.polkadot.network/t/mis-configuring-pallet-elections-phragmen/2502/1 "2023-04-03T18:21:14Z")

</div>

We have identified there are possibly mis-configured `elections-phragmen` pallet.

The gist of the issue is that this pallet performs the full election process (phragmen algorithm by default) onchain, and `on_initialize` . This, if overweight, will cause your chain to stall.

To fix this, there are number of things you need to know:

- Foremost, set reasonably high deposits, so that at least if your chain stalls, someone needs to lock good amount of funds for it.
  - [Config in pallet\_elections\_phragmen::pallet - Rust](https://paritytech.github.io/substrate/master/pallet_elections_phragmen/pallet/trait.Config.html#associatedtype.CandidacyBond)
  - [Config in pallet\_elections\_phragmen::pallet - Rust](https://paritytech.github.io/substrate/master/pallet_elections_phragmen/pallet/trait.Config.html#associatedtype.VotingBondBase)
  - [Config in pallet\_elections\_phragmen::pallet - Rust](https://paritytech.github.io/substrate/master/pallet_elections_phragmen/pallet/trait.Config.html#associatedtype.VotingBondFactor)

> as a side note, low deposits also played a role in this attack: [Thoughts on governance security and configs for parachains](https://forum.polkadot.network/t/thoughts-on-governance-security-and-configs-for-parachains/1166)

- Set maximums. The pallet is configured so that if it has more candidates and voters, it will just not do any election:
  - [Config in pallet\_elections\_phragmen::pallet - Rust](https://paritytech.github.io/substrate/master/pallet_elections_phragmen/pallet/trait.Config.html#associatedtype.MaxCandidates)
  - [Config in pallet\_elections\_phragmen::pallet - Rust](https://paritytech.github.io/substrate/master/pallet_elections_phragmen/pallet/trait.Config.html#associatedtype.MaxVoters)

> The main problem we have seen is that some have set these numbers to really high values like 10,000 voters. **These number are possible copy-pasted from substrate’s `kitchensink-runtime` . Don’t do that!** The configurations of this runtime are not meant for production use.

- As soon as this PR is merged, you will be able to control the number of voters per voter as well. This should help you further reduce the weight, and in turn have more voters:
  - [https://github.com/paritytech/substrate/pull/13305](https://github.com/paritytech/substrate/pull/13305)

- As soon as this PR is merged, you should be able to configure the pallet to use a simpler election process, such as simple approval voting, which should make your council elections more scalable.
  - [https://github.com/paritytech/substrate/pull/12588](https://github.com/paritytech/substrate/pull/12588)

- Finally, how should you determine the maximum voters? You can inspire from the newly added `fn integrity_test` in [https://github.com/paritytech/substrate/pull/13305](https://github.com/paritytech/substrate/pull/13305). If you runtime is already setting a value too high, the test should emit a warning.