# Attacker can inflate stake rewards as he wants.

Elfi fee-reward accrual reads live ERC20 balanceOf instead of recorded stake, letting an attacker move stake tokens between accounts to double-claim rewards.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: KrisRenZo
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/146
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-27
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** FeeRewardsProcess.updateAccountFeeRewards staking reward accounting
**Root cause:** updateAccountFeeRewards uses IERC20(stakeToken).balanceOf(account) as the stake amount rather than the account's recorded stakeTokenBalances stakeAmount, so transient token balances count as stake.
**Steps:**
1. Have account1 and account2 each staked 1000 ETH.
2. Wait for cumulative rewards per stake token to accrue.
3. Transfer 1000 xETH from account2 to account1.
4. Call updateAccountFeeRewards(account1, stakeToken) to realize rewards on the inflated balance.
5. Repeat symmetrically for account2 to claim the same stake weight twice.
**How found:** Code reading of updateAccountFeeRewards spotted balanceOf used as stake weight, combined with the fact stake tokens are freely transferable between accounts.
**Exploitation:** Attacker shuffles stake tokens between controlled accounts (or flash-loans them) so each account's balanceOf is inflated at claim time, realizing rewards on tokens that were already counted elsewhere.
**Escalation:** Repeat across many accounts/transfers to multiply claimed rewards arbitrarily.
**Insight:** When reward math reads a live token balance instead of a recorded stake ledger, look for any path that lets the same tokens be present in multiple accounts at claim time (transfers, flash loans, self-transfers).