# _distributeProfit will use the stale globalIC.swingTraderCollateralDeficit()/swingTraderCollateralRatio(), which will result in incorrect profit distribution

ProfitDistributor reads stale globalIC collateral deficit/ratio because handleProfit callers never syncGlobalCollateral, misallocating profit between LP and swing trader cuts.

- Payout: Contest reward
- Severity: high
- Program: Malt Protocol
- Credited: cccz
- Disclosed: 2023-05-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-02-malt-findings/issues/10
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-malt%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** ProfitDistributor / StabilizerNode / SwingTrader collateral accounting
**Root cause:** handleProfit uses cached globalIC.swingTraderCollateralDeficit/Ratio, but callers (StabilizerNode.stabilize, SwingTrader.sellMalt) mutate swingTrader collateral balances without calling syncGlobalCollateral first.
**Steps:**
1. Observe ProfitDistributor._distributeProfit reads globalIC.swingTraderCollateralDeficit() and swingTraderCollateralRatio().
2. Note StabilizerNode.stabilize calls checkAuctionFinalization -> liquidityExtension.allocateBurnBudget transferring collateral to swingTrader, then profitDistributor.handleProfit(rewards) without syncGlobalCollateral.
3. Note swingTraderManager.sellMalt also increases swingTrader collateral before handleProfit.
4. Note SwingTrader._handleProfitDistribution calls dexHandler.sellMalt increasing swingTrader collateral, then profitDistributor.handleProfit(profit) without sync.
5. Stale collateral.swingTrader is lower than actual, so swingTraderCollateralDeficit() returns larger value, inflating lpCut and skewing distribution.
**How found:** Code reading of _distributeProfit's dependency on globalIC and tracing every handleProfit caller to check whether syncGlobalCollateral is invoked after collateral-moving operations.
**Exploitation:** Any profit-handling path (stabilize or swing trader sell) leaves globalIC stale; the inflated deficit shifts distributeCut toward LP cut instead of swing trader cut, misallocating protocol profit each cycle.
**Insight:** When a contract caches derived accounting state (globalIC) and reads it for payout math, enumerate every caller that mutates the underlying balances and verify a sync happens between mutation and read; missing syncs silently skew ratios.