# ZivoeYDL::distributeYield yield distribution is flash-loan manipulatable

ZivoeYDL.distributeYield computes stZVE/vestZVE split from live totalSupply(), letting an attacker flash-stake ZVE to inflate stZVE's 30-day yield share.

- Payout: Contest reward
- Severity: medium
- Program: Zivoe
- Credited: cergyk
- Disclosed: 2024-03-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/298
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** ZivoeYDL.distributeYield yield distribution contract
**Root cause:** distributeYield derives the stZVE vs vestZVE reward split from current stZVE().totalSupply() and vestZVE().totalSupply() at call time, so a temporary stake inflates stZVE's share for the next 30-day period.
**Steps:**
1. Observe distributeYield sets the stZVE/vestZVE split from live totalSupply() of both tokens.
2. Acquire a large amount of ZVE (flash loan) and stake it into stZVE, raising stZVE totalSupply.
3. Call `ZivoeYDL.distributeYield()` so the inflated ratio is snapshotted for the next 30 days.
4. Unstake and repay/sell ZVE; stZVE now receives an inflated share of yield at vestZVE's expense.
**How found:** Code review of distributeYield's reward-split math revealed it reads manipulable live totalSupply() values rather than a time-locked or past snapshot, prompting the flash-stake manipulation hypothesis.
**Exploitation:** Attacker flash-borrows ZVE, stakes to inflate stZVE totalSupply, calls distributeYield in the same block to lock in a higher stZVE reward rate for 30 days, then unstakes and repays the loan, capturing inflated yield as an existing stZVE holder.
**Insight:** When a reward split is computed from live token totalSupply() at distribution time, a single-block stake can permanently skew the ratio for the whole distribution period; check whether ratios use snapshots or time-locks.