# Vault rewards can be gamed

Vault weight credited from swap value of any depositable synth, so attacker mints a worthless custom-token synth at inflated price to capture nearly all vault rewards.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/222
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-18
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation vuln:reward-distribution

**Target:** Vault deposit/harvest reward accounting with permissionless synth deployment
**Root cause:** _deposit sets member weight to calcValueInBase of the deposited synth amount, and anyone can deploy a synth for an arbitrary custom token; a thin pool with 1 wei TOKEN and 10^18 BASE makes that token's price enormous, inflating weight independent of real value.
**Steps:**
1. Create a custom ERC20 token and mint a large supply to the attacker.
2. Call `Pools.deploySynth(customToken)` to create a synth for it.
3. Add liquidity to the `TOKEN <> BASE` pair with `1 wei` TOKEN and `10^18` BASE, making TOKEN price very expensive.
4. Mint synths by paying BASE to the pool.
5. Deposit the fake synth into the vault; `_weight = iUTILS(UTILS()).calcValueInBase(iSYNTH(_synth).TOKEN(), _amount)` becomes very high.
6. Call `harvest(realSynth)` with a valuable synth to collect rewards pro rata to the inflated weight.
**How found:** Noticed `calcReward` completely disregards the `synth` parameter and that `_deposit` weights deposits by swap value while synth creation is permissionless, implying weight can be decoupled from real deposited value.
**Exploitation:** Attacker inflates member weight with a valueless custom synth, then harvests using a real synth; rewards are distributed pro rata to weight, which is independent of the actual synth deposited, so the attacker earns almost all vault rewards.
**Insight:** When reward weight is derived from a price/swap-value oracle, check whether the priced asset can be permissionlessly created and its pool made arbitrarily thin — a 1 wei/10^18 pool sets an absurd unit price that flows straight into weight.