# Maia Governance token balance dilution in vMaia vault is breaking the conversion rate mechanism

vMaia vault mints pbHermes on deposit but never burns on withdrawal, letting repeated deposit/withdraw cycles dilute the vault balance and DoS increaseConversionRate.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO Ecosystem
- Credited: 0xTheC0der
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/473
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AM-22
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** ERC4626PartnerManager / vMaia ERC-4626 vault
**Root cause:** pbHermes is minted to the vault proportional to deposits but never burned on withdrawal, so the vault's pbHermes balance grows unbounded relative to bHermes. increaseConversionRate derives its lower bound from that balance, so once pbHermes > bHermes the min rate exceeds the max rate and the call reverts.
**Steps:**
1. Deposit Maia into vMaia to receive shares (testDepositMaia).
2. Warp to withdrawal Tuesday.
3. Loop: `vmaia.withdraw(amount, ...)` then `maia.approve(vmaia, amount)` and `vmaia.deposit(amount, ...)`.
4. Observe vault pbHermes balance doubling each cycle (100e18 -> 200e18 -> 400e18 ...) while bHermes stays 1000e18.
5. Compute `minNewConversionRate = pbHermesBal / vmaia.totalSupply()` and call `vmaia.increaseConversionRate(minNewConversionRate)`.
6. Once pbHermesBal > bHermesBal, the call reverts with `InsufficientBacking`.
**How found:** Code reading of ERC4626PartnerManager: noticed _burn on withdrawal lacks the pbHermes burn that _deposit performs via mint, then traced how increaseConversionRate's min/max bounds (L219/L226) depend on the vault's pbHermes and bHermes balances, hypothesizing dilution could invert the bounds.
**Exploitation:** Any user with Maia tokens can repeatedly withdraw and redeposit within a single transaction (or across cycles) to inflate the vault's pbHermes balance, permanently blocking the owner from raising the pbHermes<>bHermes conversion rate. No direct fund theft; griefing/DoS of protocol parameter updates.
**Insight:** When a vault mints a partner/governance token on deposit, check whether the symmetric burn exists on withdrawal; asymmetric mint/burn lets any user inflate the vault's internal token balance and break any logic that derives rates or bounds from that balance.