# `msg_server_stake::AddStake` calculates the weight incorrectly resulting in incorrect activation of a topic

AddStake passes the staked amount as additional fee revenue to weight calculation, inflating topic weight and activating topics prematurely.

- Payout: Contest reward
- Severity: medium
- Program: Allora
- Credited: 0x3b
- Disclosed: 2024-06-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-allora-judging/issues/121
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-32
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Cosmos SDK emissions module msg_server_stake AddStake
**Root cause:** AddStake passes msg.Amount (the added stake) as the additionalRevenue argument to activateTopicIfWeightAtLeastGlobalMin, which forwards it to GetCurrentTopicWeight as added fee revenue, so stake is double-counted as revenue in the weight formula.
**Steps:**
1. Reputer calls AddStake with msg.Amount on a topic below activation threshold
2. AddStake updates topic stake, then calls `activateTopicIfWeightAtLeastGlobalMin(ctx, ms, msg.TopicId, msg.Amount)`
3. That amount flows into `GetCurrentTopicWeight` as `additionalRevenue` and is added to existing fee revenue
4. `GetTargetWeight` computes weight = S^μ * (P/C)^ν using inflated P, exceeding global min
5. Topic is activated despite not reaching required weight
**How found:** Code reading of AddStake's call into activateTopicIfWeightAtLeastGlobalMin, noticing the last argument was msg.Amount (stake) but the callee treats it as additionalRevenue (fee revenue).
**Exploitation:** Any reputer adding stake can trigger premature topic activation by having their stake amount counted as fee revenue, bypassing the intended weight threshold.
**Insight:** When a helper takes an 'additional revenue' parameter, trace every caller to confirm they pass revenue and not a same-typed value like stake amount; unit-mismatched decimals in Go/Cosmos code hide this.