# Malicious borrower can decrease Guild holders reward

Borrower flash-loans gUSDC, stakes via SurplusGuildMinter right before notifyPnL, then unstakes, capturing most GUILD reward split and diluting other stakers.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: SBSecurity
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/994
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:race-window vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** SurplusGuildMinter / ProfitManager gauge reward accounting
**Root cause:** Gauge reward index is snapshotted at notifyPnL based on current stake weight; staking and unstaking in the same block lets an attacker inflate weight only for the reward-triggering transaction.
**Steps:**
1. Borrower opens loan (e.g. 100 gUSDC) and waits for interest to accrue.
2. Attacker flash-loans large USDC, mints gUSDC via PSM.
3. `sgmUSDC.stake(termUSDC, 10_000_000e18)` to become dominant gauge weight.
4. Repay loan to trigger `profitManagerUSDC.notifyPnL(termUSDC, interest)`, updating `_gaugeProfitIndex`.
5. `sgmUSDC.unstake(termUSDC, 10_000_000e18)`, redeem via PSM, repay flash loan.
6. Collect credit/guild rewards accrued for the single-block stake.
**How found:** Reading SurplusGuildMinter stake/unstake and ProfitManager notifyPnL reward-index logic; noticed reward weight is measured at notify time with no time-weighting or lock, enabling same-block stake/unstake.
**Exploitation:** Flash loan large gUSDC, stake into the target term immediately before notifyPnL fires, then unstake after; attacker captures ~all of the guildSplit reward for that PnL event while paying only loan interest (~$4-5) and gas.
**Escalation:** Can be simplified to a frontrun/backrun sandwich around notifyPnL without flash loan if attacker holds tokens.
**Insight:** When a reward index is updated on discrete PnL events, check whether stake weight is time-weighted or locked; if not, a just-in-time stake around the notify call captures the split.