# A user can 'borrow' dMute balance for a single block to increase their amplifier APY

Amplifier APY reads dMute delegation balance only at staking block, letting users borrow delegated votes for one block to inflate rewards.

- Payout: Contest reward
- Severity: medium
- Program: Mute.io
- Credited: 0xA5DF
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-mute-findings/issues/36
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** MuteAmplifier staking contract / dMute delegation
**Root cause:** calculateMultiplier reads getPriorVotes(account, staked_block) only at the staking block, so the dMute delegation balance is snapshotted once and never re-checked, despite dMute being freely delegable.
**Steps:**
1. Lender holds dMute and delegates votes to borrower via dSoulBound delegate.
2. Borrower calls stake in MuteAmplifier in the same block so staked_block records the inflated getPriorVotes balance.
3. calculateMultiplier(account, true) uses getPriorVotes(account, staked_block) to set a high multiplier.
4. Lender cancels delegation next block; borrower keeps the boosted APY without holding dMute.
**How found:** Reading calculateMultiplier, noticed the balance is sampled only at staked_block via getPriorVotes, then checked dSoulBound to confirm delegation is unrestricted, contradicting the soulbound-transfer assumption.
**Exploitation:** A dMute holder delegates votes to a staker for a single block; the staker stakes in that block, locking in a high multiplier from getPriorVotes at staked_block. Delegation is revoked next block, so the same dMute can be reused to boost many stakers simultaneously, diluting rewards meant for long-term holders.
**Escalation:** Lender can automate via a contract to offer delegation as a service, reusing the same dMute across many stakers.
**Insight:** When a reward multiplier reads a snapshot (getPriorVotes at a past block) rather than a time-averaged or minimum balance, check whether the underlying voting/delegation token can be delegated or flash-acquired for exactly that block.