In parties with more than one host, a single host can bypass the execution delay of a proposal by transferring his host status to other addresses of his.
Audit: 2023-10-party-findings
Severity: HIGH

# Lines of code

https://github.com/PartyDAO/party-protocol/blob/37dae4292dde2547a3b1ced8a041f926e1b37d58/contracts/party/PartyGovernance.sol#L629


# Vulnerability details

### The Vulnerability
---
After a proposal has gathered enough votes to pass, it waits through a period defined in the governance values named `executionDelay`. That `executionDelay` period is bypassed and the proposal can be executed immediately if ALL hosts of the party vote on the proposal or the proposal is unanimously voted, meaning all party members voted on that proposal.

In the `accept()` in `PartyGovernance.sol` contract. In line 646, it relies on a state variable mapping named `isHost` to if the call sender is a host. If that is the case, the number of hosts that voted on that particular proposal is increased by one `++values.numHostsAccepted;`. https://github.com/PartyDAO/party-protocol/blob/37dae4292dde2547a3b1ced8a041f926e1b37d58/contracts/party/PartyGovernance.sol#L629
```solidity
    uint96 votingPower = getVotingPowerAt(msg.sender, values.proposedTime - 1, snapIndex);
    values.votes += votingPower;
    if (isHost[msg.sender]) {
        ++values.numHostsAccepted;
    }
    info.values = values;
    emit ProposalAccepted(proposalId, msg.sender, votingPower);
```

It is also worth noting that if a user has 0 intrinsic and 0 delegated voting power, that won't prevent him from voting on a proposal. If there are no inserted voting power snapshots for that user then the call won't revert.

This very simple way of tracking how many hosts voted the proposal doesn't prevent a single host from doing the following:
1. Vote on the proposal
2. Transfer his host status to another address he owns and vote on the proposal
3. Repeat

Repeating these steps over and over until the `numHostsAccepted` value is equivalent to the number of hosts at the time of creation of the proposal will allow a single host to bypass the execution delay of a proposal that has gathered enough votes

Interestingly, a single host can execute the same attack to prevent the execution delay from being bypassed even if all other hosts in the party have voted on the proposal, observe the following function (https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/party/PartyGovernance.sol#L1053):
```solidity
    function _getProposalFlags(ProposalStateValues memory pv) private view returns (uint256) {
        uint256 flags = 0;
        if (_isUnanimousVotes(pv.votes, pv.totalVotingPower)) {
            flags = flags | LibProposal.PROPOSAL_FLAG_UNANIMOUS;
        }
        if (_hostsAccepted(pv.numHosts, pv.numHostsAccepted)) {
            flags = flags | LibProposal.PROPOSAL_FLAG_HOSTS_ACCEPT;
        }
        return flags;
    }
```
https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/party/PartyGovernance.sol#L1122
```solidity
    function _hostsAccepted(
        uint8 snapshotNumHosts,
        uint8 numHostsAcc