# ERC4626PartnerManager.sol mints extra partnerGovernance tokens to itself, resulting in over supply of governance token

ERC4626PartnerManager.increaseConversionRate mints totalSupply*newRate minus current balance instead of the rate delta, over-minting partnerGovernance tokens on every rate increase.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO Ecosystem
- Credited: T1MOH
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/191
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AM-39
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** ERC4626PartnerManager.sol increaseConversionRate / _mint
**Root cause:** increaseConversionRate computes mint amount as totalSupply*newRate - partnerGovernance.balanceOf(this), but the contract's balance shrinks on claims, so it mints the full new backing rather than only the delta (newRate - oldRate).
**Steps:**
1. Set bHermesRate=10, totalSupply=0, bHermes balance=50.
2. User1 deposits 5 MAIA; _mint mints 5*10=50 partnerGovernance to the contract.
3. Owner calls increaseConversionRate(11).
4. Function mints totalSupply*11 - balanceOf(this) = 55 - 0 = 55 tokens instead of 5*(11-10)=5.
5. Excess partnerGovernance accumulates in the contract each rate increase.
**How found:** Code reading of increaseConversionRate: noticed the mint formula subtracts the contract's current partnerGovernance balance, which decreases on claims, so the subtraction does not represent prior minted backing.
**Exploitation:** Owner-triggered rate increase over-mints governance tokens to the contract; excess tokens are approved to partnerVault and could be extracted if that out-of-scope contract allows it, and inflated totalSupply skews voting.
**Insight:** When a mint formula subtracts a live token balance to compute a delta, check whether that balance is actually consumed/claimed elsewhere; a shrinking balance makes the delta wrong and re-mints prior backing.