# Users can deflate other markets Guild holders rewards by staking less priced token

SurplusGuildMinter.stake() lacks a check that the term's CREDIT token matches the minter's, letting a cheap-token stake inflate another market's gaugeWeight and dilute its Guild rewards.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: SBSecurity
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/1032
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-09
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** SurplusGuildMinter.stake() lending term / gauge weight
**Root cause:** stake() never verifies the passed term belongs to the same market as the SurplusGuildMinter's CREDIT token, so a gUSDC minter can increment the gWETH term's gauge using cheaper gUSDC.
**Steps:**
1. Deploy gUSDC and gWETH markets each with their own SurplusGuildMinter (mintRatio 2).
2. Mint gUSDC via USDC; approve sgmUSDC.
3. Call `sgmUSDC.stake(termWETH, 100e18)` — mints Guild at 2:1 and increments termWETH gaugeWeight.
4. Gauge(gWETH) weight rises 180e18 -> 380e18, halving per-staker rewards on notifyPnL.
5. Call `sgmUSDC.unstake(termWETH, 100e18)` to recover principal; exploiter earns 0 rewards but others' rewards are diluted.
**How found:** Noticed stake() takes an arbitrary term without validating its creditToken against the minter's own credit token, then reasoned that with multiple markets (gUSDC/gWETH) a cheap token could be used to weight a different market's gauge.
**Exploitation:** Attacker stakes a low-priced CREDIT token through the wrong market's SurplusGuildMinter to inflate a target term's gaugeWeight, waits for notifyPnL to distribute guild rewards, then unstakes to recover capital; no slashing if term has no losses.
**Insight:** When a staking/minter contract is deployed per-market but accepts a term address as a parameter, check whether the term's token is validated against the contract's own token — cross-market gauge weighting is a cheap griefing vector.