# It's possible to perform DOS and fund lose in Stacking by transferring tokens directly to contract 

Direct STAKING_TOKEN transfers inflate Staking's contractBalance, making Yieldy.rebase divide rebasingCredits by a huge supply and revert, bricking stake/unstake.

- Payout: Contest reward
- Severity: medium
- Program: Yieldy
- Credited: unforgiven
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-yieldy-findings/issues/246
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:precision-loss

**Target:** Staking/Yieldy rebase accounting contracts
**Root cause:** Staking.rebase computes profit as contractBalance() - totalSupply, so tokens sent directly to the contract inflate profit; Yieldy.rebase then computes rebasingCredits / updatedTotalSupply which truncates to 0 and reverts on require(rebasingCreditsPerToken > 0).
**Steps:**
1. Deploy/observe Staking contract with Yieldy token.
2. Call `stake(1 wei)` so rebasingCredits becomes ~2 wad.
3. Transfer a large amount of STAKING_TOKEN directly to the Staking contract address.
4. Trigger `Staking.rebase()`; contractBalance() - totalSupply yields large _profit.
5. Yieldy.rebase computes `rebasingCreditsPerToken = rebasingCredits / updatedTotalSupply` == 0 and reverts on `require(rebasingCreditsPerToken > 0)`.
6. All subsequent stake/instantUnstakeReserve/instantUnstakeCurve calls revert.
**How found:** Code review of Yieldy.rebase's `rebasingCredits / updatedTotalSupply` division and tracing that Staking.rebase feeds it `contractBalance() - totalSupply`, which is manipulable by direct token transfers.
**Exploitation:** Attacker needs no capital gain: stake 1 wei, then donate STAKING_TOKEN to the contract so the next rebase's profit exceeds rebasingCredits, forcing integer division to zero and permanent revert of rebase-dependent functions.
**Insight:** When a rebase/reward function derives profit from `token.balanceOf(contract) - totalSupply`, any direct donation becomes attacker-controlled input to a division; check whether the divisor can be pushed past the numerator to force a zero-truncation revert.