# Exponential Inflation of Voice Credits in Quadratic Voting Strategy

QVBaseStrategy double-counts prior voice credits when accumulating allocations, causing exponential inflation of a recipient's voting weight across repeated allocations.

- Payout: Contest reward
- Severity: medium
- Program: Gitcoin
- Credited: 0x00ffDa
- Disclosed: 2023-09-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-Gitcoin-judging/issues/48
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** QVBaseStrategy.sol _qv_allocate voice credit accounting
**Root cause:** totalCredits already includes creditsCastToRecipient, but the update adds totalCredits back onto the existing mapping value, re-adding prior credits each call.
**Steps:**
1. Call `_qv_allocate` with `_voiceCreditsToAllocate=5` for a recipient: mapping goes 0 -> 5.
2. Call again with 5: totalCredits=10, mapping becomes 5+10=15.
3. Call again with 5: totalCredits=20, mapping becomes 15+20=35.
4. Observe super-linear growth instead of linear +5 per allocation.
**How found:** Code reading of the accumulation line; noticed totalCredits already contains creditsCastToRecipient yet is added to the mapping that still holds the old value.
**Exploitation:** An allocator repeatedly allocates small credit amounts to the same recipient across multiple transactions, compounding the recorded voiceCreditsCastToRecipient and skewing QV results and matching-fund distribution.
**Insight:** In accumulator patterns, check whether the value being added already includes the stored state; a `+=` on a variable that itself sums the old mapping value causes geometric growth.