diff --git a/src/graphql/operations/vp.ts b/src/graphql/operations/vp.ts
index 7c90ef23..4e71601e 100644
--- a/src/graphql/operations/vp.ts
+++ b/src/graphql/operations/vp.ts
@@ -5,9 +5,13 @@ const scoreAPIUrl = process.env.SCORE_API_URL || 'https://score.snapshot.org';
 
 export default async function (_parent, { voter, space, proposal }) {
   if (proposal) {
-    const query = `SELECT * FROM proposals WHERE id = ?`;
+    const query = `SELECT * FROM proposals WHERE id = ? LIMIT 1`;
     const [p] = await db.queryAsync(query, [proposal]);
 
+    if (!p) {
+      return Promise.reject(new Error('proposal not found'));
+    }
+
     return await snapshot.utils.getVp(
       voter,
       p.network,
@@ -20,6 +24,11 @@ export default async function (_parent, { voter, space, proposal }) {
   } else if (space) {
     const query = `SELECT settings FROM spaces WHERE id = ? AND deleted = 0 LIMIT 1`;
     let [s] = await db.queryAsync(query, [space]);
+
+    if (!s) {
+      return Promise.reject(new Error('space not found'));
+    }
+
     s = JSON.parse(s.settings);
 
     return await snapshot.utils.getVp(voter, s.network, s.strategies, 'latest', space, false, {