# Beneficiary credit balance can unwillingly be used to mint low tier NFT 

Attacker pays tiny amount naming victim as beneficiary, forcing victim's accumulated credit to mint a low-tier NFT, diluting governance voting power.

- Payout: Contest reward
- Severity: medium
- Program: Juicebox
- Credited: minhquanym
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-juicebox-findings/issues/160
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Juicebox NFT payment terminal / didPay credit accounting
**Root cause:** _processPayment sums the incoming _value with the beneficiary's existing creditsOf balance and mints against the combined amount, without requiring the beneficiary's consent, so a third party's small payment triggers minting of the victim's saved credits at a low tier.
**Steps:**
1. Victim Alice accumulates creditsOf[Alice] = 19 ETH (e.g. leftover below threshold or dontMint).
2. Tiers: Tier A threshold 20 ETH/100 votingUnits, Tier B threshold 10 ETH/10 votingUnits.
3. Attacker Bob calls terminal pay with 1 ETH and _data.beneficiary = Alice.
4. didPay -> _processPayment: _leftoverAmount = _value + creditsOf[Alice] = 20 ETH.
5. Contract mints 2 Tier B NFTs to Alice, consuming her 19 ETH credit for only 20 voting power instead of 100.
**How found:** Code reading of _processPayment: noticed _leftoverAmount = _value + _credits combines attacker-supplied value with victim's stored credit, and didPay only checks caller is a project terminal, not beneficiary consent.
**Exploitation:** Attacker only needs to send a minimal payment (enough to cross the lowest minting threshold) with the victim set as beneficiary; the victim's stored credit is consumed to mint low-tier NFTs, degrading their governance weight.
**Escalation:** If NFTs feed a governance system, attacker can dilute a large holder's voting power to influence decisions like minting tokens or moving community funds.
**Insight:** In credit/accumulator designs, check whether a third party can trigger consumption of another user's stored balance by supplying that user as beneficiary; combined-amount minting lets an attacker choose the tier outcome for someone else's funds.