# ProfitManager's creditMultiplier calculation does not count undistributed rewards; this can cause value losses to users

ProfitManager slashes creditMultiplier using totalSupply() instead of targetTotalSupply(), over-penalizing holders and locking collateral in SimplePSM.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: 3docSec
- Disclosed: 2024-02-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/292
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-24
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** ProfitManager.notifyPnL creditMultiplier slashing in lending protocol
**Root cause:** Loss slashing divides by CreditToken.totalSupply(), which excludes unminted rebase rewards still interpolating, instead of targetTotalSupply(); the multiplier drops more than warranted.
**Steps:**
1. Set ProfitManager profit sharing to 100% creditSplit so rewards accrue as unminted rebase rewards.
2. User1 mints 3000 gUSDC via PSM and enters rebase; users 2-4 each borrow 1000 gUSDC and redeem to USDC.
3. Accrue 50% interest, call loanB, then user2 repays loanA adding 500 profit; totalSupply=3000 but targetTotalSupply=3500.
4. `ah.forgive(loanB)` reports 1000 loss: multiplier = 1e18*(3000-1000)/3000 = 0.6667e18 instead of 0.714285e18.
5. User4 repays loanC at inflated debt 2250 gUSDC; user1 waits DISTRIBUTION_PERIOD and redeems 4250 gUSDC for only ~2833 USDC.
6. ~166 USDC remains locked in SimplePSM due to over-slashed multiplier.
**How found:** Noticed notifyPnL uses totalSupply() while the analogous totalBorrowedCredit() accounting uses targetTotalSupply(); hypothesized the discrepancy matters when a large share of supply sits in undistributed rebase rewards, then built a Foundry PoC to quantify the locked value.
**Exploitation:** No attacker profit path; the flaw systematically over-depreciates CREDIT on any loss event while rewards are mid-distribution, leaving surplus collateral stranded in SimplePSM that governance must emergencyAction to redistribute.
**Insight:** When a protocol has two supply notions (minted vs. target/interpolated), audit every ratio and slashing formula for which one it uses; mismatched supply bases silently misprice shares during reward interpolation windows.