# Pods Finance Logic Error Bugfix Review

Pods Finance reward math paid out based on full share balance during partial unmint, letting any past minter repeatedly drain reward pool.

- Payout: $4,000
- Severity: high
- Program: Pods Finance
- Credited: Csanuragjain
- Disclosed: 2021-06-30
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/pods-finance-logic-error-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pods-finance-logic-error-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** Solidity options contracts AavePodPut.sol / AavePodCall.sol unmintWithRewards()
**Root cause:** rewardsToSend computed from shares[msg.sender] alone, ignoring amountOfOptions, so a partial unmint paid rewards as if 100% of shares were burned.
**Steps:**
1. Mint at least one option to obtain shares[msg.sender] > 0.
2. Call `unmintWithRewards(amountOfOptions)` with a minimal amountOfOptions that still passes `require(strikeToSend > 0)`.
3. Contract computes `rewardsToSend = shares[msg.sender].mul(_rewardBalance()).div(totalShares)` — full share value — and transfers it.
4. Repeat the call each time; shares are not proportionally reduced relative to reward paid, draining the reward balance.
**How found:** Compared unmintWithRewards() against withdraw(): withdraw always burns 100% of shares, but unmint allows partial unmint while the reward formula still assumed full-share redemption — the mismatch between partial unmint and full-share reward math was the tell.
**Exploitation:** Attacker with any prior mint repeatedly calls unmintWithRewards() with a tiny amountOfOptions, each call paying out rewards proportional to their entire share balance rather than the fraction unminted, siphoning yield owed to other users until the reward asset balance is drained. Requires gas only; no capital beyond an initial mint.
**Insight:** When a contract has both a full-exit and a partial-exit path, diff their accounting formulas: any payout computed from stored share balance rather than the amount actually burned is over-payable by looping the partial path.