The 51% majority can hijack the party's precious tokens through an arbitrary call proposal if the `AddPartyCardsAuthority` contract is added as an authority in the party.
Audit: 2023-10-party-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/authorities/AddPartyCardsAuthority.sol#L29


# Vulnerability details

### Pre-requisite knowledge & an overview of the features in question
---
1. The [**`AddPartyCardsAuthority`**](https://github.com/code-423n4/2023-10-party/blob/main/contracts/authorities/AddPartyCardsAuthority.sol) contract: The **`AddPartyCardsAuthority`** contract is a contract designed to be integrated into a Party and it has only one purpose, and it is to mint new party governance NFT tokens for party members. 
    - The party has to add this contract as an authority before it can start minting new party governance NFT tokens for users. 
    - The **`AddPartyCardsAuthority`** contract is deployed on the mainnet on address `0xC534bb3640A66fAF5EAE8699FeCE511e1c331cAD`

2. The 51% Majority attack: The PartyDAO team has put a lot of safeguards on a type of proposal called `ArbitraryCallsProposal` to prevent the 51% majority of the party to steal the precious NFT tokens of the party through this type of proposal. For a precious NFT token to be transferred out of the party to any other entity through this proposal, the proposal needs to be unanimously voted (100% of party members have voted on that proposal).
---

### Overview of the vulnerability
---
There is no check on the [`ArbitraryCallsProposal`](https://github.com/code-423n4/2023-10-party/blob/main/contracts/proposals/ArbitraryCallsProposal.sol) proposal contract that prevents the calling of the [`AddPartyCardsAuthority`](https://github.com/code-423n4/2023-10-party/blob/main/contracts/authorities/AddPartyCardsAuthority.sol) contract. This allows the 51% majority, through an arbitrary call proposal, to hijack ALL of precious tokens of the party.

They can achieve this by going through the following steps:
1. Create an `ArbitraryCallsProposal`, to simply mint a governance NFT token for an arbitrary user with an astronomical voting power which gives the arbitrary user an ability to pass and bypass the execution delay of any proposal.
2. The newl-created arbitrary user will create an `ArbitraryCallsProposal` with multiple arbitrary calls with a goal of transferring all of the party precious tokens to him.
3. The newly created arbitrary user will then vote on the `ArbitraryCallsProposal` proposal he has just created.
4. The proposal will pass and be marked as unanimously voted proposal allowing him to bypass all of the safeguards in place to prevent the hijacking of precious NFT tokens through a non-unanimously voted proposal.
---
### Proof of concept
---
**How to run**:
1. Add the following code to a file with a name of your liking with an extension of ".t.sol"
2. Add the created file to the [`test/`](https://github.com/PartyDAO/party-protocol/tree/main/test) folder
2. Run the following command: `forge test --match-contract TestHijackPreciousTokens --match-test testHijackPreciousExploit -vv`
```solidity
// SPDX