# The EUSDMiningIncentives contract is incorrectly implemented and can allow for more than the intended amount of rewards to be minted

EUSDMiningIncentives computes per-user stake from borrowed EUSD+PeUSD but divides by EUSD totalSupply only, inflating esLBR rewards minted.

- Payout: Contest reward
- Severity: medium
- Program: Lybra Finance
- Credited: Toshii
- Disclosed: 2023-08-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-lybra-findings/issues/867
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AM-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** EUSDMiningIncentives staking rewards contract
**Root cause:** stakedOf sums borrowed EUSD and PeUSD across all pools (with peUSDExtraRatio boost), but totalStaked returns only EUSD.totalSupply(), so numerator exceeds denominator.
**Steps:**
1. Read stakedOf: loops pools, sums pool.getBorrowedOf(user), scaling vaultType==1 by (1e20+peUSDExtraRatio)/1e20.
2. Read totalStaked: returns EUSD.totalSupply() only, excluding PeUSD vault supplies.
3. Read earned: stakedOf(user)*getBoost*(rewardPerToken()-userRewardPerTokenPaid)/1e38 + rewards.
4. Read rewardPerToken: rewardRatio*(lastTimeRewardApplicable()-updatedAt)*1e18 / totalStaked().
5. Observe numerator includes PeUSD borrowed while denominator omits PeUSD supply, inflating rewardPerToken and earned.
**How found:** Manual review comparing Synthetix-style staking invariant: stakedOf numerator must match totalStaked denominator; noticed totalStaked only counts EUSD while stakedOf counts EUSD+PeUSD.
**Exploitation:** Any staker accrues esLBR faster than intended because rewardPerToken is inflated by the mismatched denominator; repeated claims mint excess esLBR, diluting/inflating supply beyond design.
**Insight:** In Synthetix-derived reward contracts, verify stakedOf and totalStaked use the same asset set and scaling; a boosted numerator (peUSDExtraRatio) with an unscaled denominator silently inflates emissions.