# The userGaugeProfitIndex is not set correctly, allowing an attacker to receive rewards without waiting

ProfitManager skips setting userGaugeProfitIndex when userGaugeWeight is zero, letting a late voter claim matured gauge rewards without waiting.

- Payout: Contest reward
- Severity: high
- Program: Ethereum Credit Guild
- Credited: Arz
- Disclosed: 2024-02-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/1194
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** ProfitManager.claimGaugeRewards / GuildToken.incrementGauge
**Root cause:** claimGaugeRewards returns early when _userGaugeWeight==0 without initializing userGaugeProfitIndex, so the first real claim treats index 0 as baseline and pays out the full accumulated gaugeProfitIndex delta.
**Steps:**
1. Deploy ProfitManager with profit sharing config (creditSplit 0.5e18, guildSplit 0.5e18).
2. Bob votes 400e18 into gauge1; mint 20e18 credit to ProfitManager and call `notifyPnL(gauge1, 20e18)` raising gaugeProfitIndex to ~1.025e18.
3. Attacker calls `guild.incrementGauge(gauge1, 150e18)` after profit notified; internal claimGaugeRewards returns early (weight was 0), leaving userGaugeProfitIndex=0.
4. Attacker calls `profitManager.claimGaugeRewards(attacker, gauge1)`; index 0 baseline yields full delta, draining credit rewards.
5. Bob's subsequent claimGaugeRewards reverts with `ERC20: transfer amount exceeds balance`.
**How found:** Code reading of claimGaugeRewards early-return on zero weight, noticing userGaugeProfitIndex never initialized, then reasoning that a first-time voter after notifyPnL gets index 0 baseline.
**Exploitation:** Attacker mints/acquires GUILD, waits for notifyPnL to inflate gaugeProfitIndex, then votes into the gauge in the same block and immediately claims, receiving rewards proportional to full index delta despite zero prior participation; repeatable to drain all matured rewards.
**Insight:** In reward-index accounting (MasterChef-style), any early-return path that skips writing the user's index snapshot creates a free accrual window; check every branch that can exit before updating userGaugeProfitIndex.