# Reward eligibility missing stake or time gate

Reward paths that pay without enforcing minimum stake, active status, or future start time

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-08-04. Updated 2026-10-25._

## How it works
A reward or withdrawal path assumes that only legitimately staked, active, time-eligible positions can collect. The check that should enforce that assumption is missing, off by one, or derived from attacker-controlled input. The result is a position that should not qualify (zero stake, unlocked plot, past epoch, arbitrary vote count) still passes validation and mints or drains rewards that are not backed by real locked value.

## Where it shows up
- Validation comparing an index or count with `<` where a zero count must invalidate index 0 [E1](https://bugbountylibrary.com/r/c4%3A2024-07-munchables%3AH-02.md)
- Loop bounds or array lengths decoded from user-supplied bytes instead of a fixed constant [E2](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-11.md)
- Epoch/period validators that check upper bounds but omit a lower bound relative to current time [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-05.md)
- Stake entry points accepting user-supplied quantity and end date without minimum or range checks [E4](https://bugbountylibrary.com/r/dhl%3A20230117-omniestate.md)
- Reward claim/withdraw paths that never re-check active status or lock expiry

## How to review
For every path that pays out, identify the exact predicate that must hold (stake >= minimum, status active, start in future, count fixed) and confirm it is enforced on-chain at claim time, not just at entry. Test boundary values: zero stake, zero timestamp, index 0, count 0, start_epoch == current_epoch. The invariant: a position can only earn rewards proportional to value actually locked for the required duration.

## Variants seen
- Off-by-one boundary: strict `<` lets plotId 0 farm after full unlock [E1](https://bugbountylibrary.com/r/c4%3A2024-07-munchables%3AH-02.md)
- Unvalidated array length controls number of Elo battles, inflating maturity [E2](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-11.md)
- Missing lower bound on start_epoch allows retroactive farms [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-05.md)
- No input validation on stake amount/end date lets 1 wei claim outsized rewards [E4](https://bugbountylibrary.com/r/dhl%3A20230117-omniestate.md)

## Impact and severity
Unbacked reward minting, skewed reward distribution, and direct fund drain (~236 BNB in [E4](https://bugbountylibrary.com/r/dhl%3A20230117-omniestate.md)). Severity is high when the path is permissionless and repeatable [E1](https://bugbountylibrary.com/r/c4%3A2024-07-munchables%3AH-02.md); worse when rewards are shared, since one actor's inflation dilutes all honest stakers [E2](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-11.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-05.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-munchables%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-11.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-05.md
- E4: https://bugbountylibrary.com/r/dhl%3A20230117-omniestate.md