# Tidal Finance Logic Error Bugfix Review

Tidal Finance staking contract left user.rewardDebt at 0 after a finished payout, letting a late depositor claim unearned staking rewards.

- Payout: $25,000
- Severity: critical
- Program: Tidal Finance
- Credited: Csanuragjain
- Disclosed: 2021-08-24
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/tidal-finance-logic-error-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-tidal-finance-logic-error-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:solidity technique:source-review vuln:business-logic

**Target:** Polygon staking contract reward payout logic
**Root cause:** After a payout is marked finished, doPayout computes user.rewardAmount but never updates user.rewardDebt, so the debt stays 0 and the rewardAmount - rewardDebt subtraction overpays.
**Steps:**
1. Admin runs startPayout/setPayout/doPayout/finishPayout for Asset Index 0, marking payout finished
2. Attacker deposits an arbitrary amount into the pool after the payout is finished
3. Wait for rewards to accumulate (e.g. a year)
4. Attacker calls `doPayout(assetIndex=0, attackerWallet)`
5. rewardAmount is credited but rewardDebt remains 0, so attacker withdraws rewards they never staked for
**How found:** Researcher read the four-step payout flow and noticed the finished-payout branch skipped the rewardDebt update, leaving the subtraction rewardAmount - rewardDebt ineffective.
**Exploitation:** Attacker joins the pool only after a payout is finalized, waits for staking rewards to accrue, then calls doPayout with the finished asset index and their own address; since rewardDebt is 0 the contract pays out rewardAmount as if fully unclaimed.
**Insight:** In staking/reward contracts, check every branch that credits rewardAmount for a matching rewardDebt update; a finished/early-return path that skips the debt sync lets late joiners claim accrued rewards.