# Rewards accrue before holders exist

Reward accrual or claim caps that start before any holder or supply exists, stranding or double-counting value

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-24._

## How it works
Reward and drip accounting assumes that whenever value accrues, someone is entitled to it and the claim path prices it the same way the deposit path does. That assumption breaks in two ways: accrual starts at a timestamp when supply or holder count is zero, so the early share belongs to nobody; or the deposit/withdraw path and the claim/squeeze path use different time bounds, so a position can cost zero to create yet still be claimable in full. In both cases the contract's internal balance no longer matches what users can legitimately withdraw.

## Where it shows up
- `notifyRewardAmount`-style functions that set `lastUpdateTime`/`periodFinish` immediately, before any stake exists [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-03.md)
- Separate accounting for deposit/withdraw versus claim/squeeze, with time caps computed from different fields [E1](https://bugbountylibrary.com/r/c4%3A2023-01-drips%3AH-01.md)
- Contracts holding yield-bearing tokens (cTokens/aTokens) on behalf of users with no call to the reward-claim function [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md)
- Drip or stream objects whose start/end precede their creation time [E1](https://bugbountylibrary.com/r/c4%3A2023-01-drips%3AH-01.md)
- Reward rate divided by `totalSupply` when supply can be zero

## How to review
Check the invariant: total claimable rewards must equal total accrued rewards, and every accrual interval must have nonzero eligible supply. Concretely: does accrual begin at first stake or at notify time? Does the claim path cap by the same `updateTime`/start bounds as the accounting path? Is `claimComp`/`claim` actually invoked and routed to the beneficiary when the contract holds yield tokens? For streams, can a drip be created with end before creation, and does the claim cap use the same bound as the cost calculation?

## Variants seen
- Drip ending before creation: zero dripped amount on removal, but squeeze caps only by cycle start, so receiver squeezes full value [E1](https://bugbountylibrary.com/r/c4%3A2023-01-drips%3AH-01.md)
- Yield tokens held by a position contract, reward claim never called, rewards accrue unclaimed and are lost [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md)
- Synthetix-style staking: accrual starts at notify with zero supply, pre-participation rewards stranded [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-03.md)

## Impact and severity
High: contract assets drained [E1](https://bugbountylibrary.com/r/c4%3A2023-01-drips%3AH-01.md), rewards permanently lost to owners [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md), stranded pre-participation rewards [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-03.md). Worse when the mismatch is silent and only surfaces at withdrawal, and when no admin path exists to recover stranded value.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-drips%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-03.md