# Unbounded and misallocated reward accrual

Reward index denominators, shrinking budgets in loops, and streams with no end time or funding check

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-03-11. Updated 2026-10-24._

## How it works
Reward accounting assumes a fixed, funded budget is split by a stable denominator. It breaks when the denominator omits balances that still earn yield, when the budget shrinks mid-distribution, or when accrual has no end time or balance check. The result is over- or under-payment and stranded or over-committed funds.

## Where it shows up
- Reward index computed as `totalAccrued / ytSupply` where claimed YBT yield still earns rewards but is left out of the denominator [E1](https://bugbountylibrary.com/r/cantina%3Anapier_february2025%3A3.1.1.md).
- A shared budget variable mutated inside a distribution loop, with a per-iteration cap recomputed against the shrinking balance [E2](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.17.md).
- A payout denominator (e.g. `poolAmount`) mutable at any time while per-recipient `paidOut` flags are permanent [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md).
- Reward streams registered with fixed `_rewardPerSecond` and no end timestamp, and no check that committed rewards are funded [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AM-5.md).

## How to review
- For index designs: confirm the denominator includes every balance that still earns yield, including claimed-but-still-accruing positions. Compare claim-early vs claim-late outcomes [E1](https://bugbountylibrary.com/r/cantina%3Anapier_february2025%3A3.1.1.md).
- For loops: verify the budget/cap is computed once before the loop, not recomputed per iteration [E2](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.17.md).
- For pools: check that funds added after partial distribution can actually be paid out, or that a recover path exists [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md).
- For streams: require an end time and assert total committed emissions <= actual token balance [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AM-5.md).
- Invariant: sum of distributable rewards equals funded balance, and each participant's share is independent of claim timing [E1](https://bugbountylibrary.com/r/cantina%3Anapier_february2025%3A3.1.1.md)[E2](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.17.md).

## Variants seen
- Index denominator omits claimed yield still earning rewards [E1](https://bugbountylibrary.com/r/cantina%3Anapier_february2025%3A3.1.1.md).
- Shrinking budget cap starves later pools in a loop [E2](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.17.md).
- Mutable pool amount with permanent paid flags locks late funds [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md).
- Unbounded accrual with no funding check over-commits and bricks claims [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AM-5.md).

## Impact and severity
Over- or under-distribution of rewards, locked funds, and bricked claims. Severity rises when one bad token or pool blocks all claims [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AM-5.md) and when misallocation is silent and repeatable [E1](https://bugbountylibrary.com/r/cantina%3Anapier_february2025%3A3.1.1.md)[E2](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.17.md).

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Anapier_february2025%3A3.1.1.md
- E2: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.17.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AM-5.md