# PnL system can be broken by large users intentionally or unintentionally.

In ProfitManager.notifyPnL, burning the surplus buffer shrinks credit totalSupply so a large loss makes creditTotalSupply - loss underflow, reverting and bricking the market.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: carrotsmuggler
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/1166
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** ProfitManager.notifyPnL / CreditToken burn in lending market
**Root cause:** notifyPnL burns the surplus buffer (reducing CreditToken totalSupply) before computing (creditMultiplier * (creditTotalSupply - loss)) / creditTotalSupply; when loss exceeds remaining totalSupply the subtraction underflows and reverts.
**Steps:**
1. Alice mints large gUSDC and stakes part into SurplusGuildMinter (tokens get burned into surplus buffer).
2. Alice's loan defaults; loss > surplusBuffer.
3. notifyPnL empties/burns surplusBuffer, dropping creditTotalSupply.
4. Compute creditTotalSupply - loss with loss > totalSupply -> underflow revert.
5. notifyPnL reverts, blocking gauge slashing, voting, and auction onBid; market stuck.
**How found:** Code reading of notifyPnL's loss-handling branch: noticed burn of surplusBuffer precedes the multiplier math, and reasoned that a whale's loss could exceed post-burn totalSupply, causing underflow.
**Exploitation:** A large borrower (or griefer) burns/stakes their credit tokens so the surplus buffer burn shrinks totalSupply below the loss; the subsequent multiplier update underflows and reverts, freezing notifyPnL and the auction flow, leaving bad debt unresolved.
**Insight:** When accounting code mutates totalSupply (burn) before computing a ratio against that same supply, check whether the numerator can underflow for large single-actor positions; borrower-controlled burn of borrowed tokens is itself an attack surface.