# ERC20Rewards breaks when setting a different token

ERC20Rewards.setRewards lets the reward token change, so unclaimed rewards from a prior period are paid in the new token, inflating value via decimal mismatch.

- Payout: Audit contest
- Severity: high
- Program: Yield
- Found by: cmichel
- Disclosed: 2021-09-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-08-yield-findings/issues/29
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-yield%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC20Rewards staking/rewards contract setRewards
**Root cause:** setRewards allows swapping the reward token without clearing or tracking pending rewards denominated in the old token, so stored amounts are reinterpreted in the new token's decimals/value.
**Steps:**
1. Deploy/observe ERC20Rewards paying rewards in DAI (18 decimals).
2. Accrue a pending reward of `1e18` (1 DAI) without claiming.
3. Admin calls `setRewards` to switch reward token to USDC (6 decimals).
4. Caller invokes `claim`; the stored `1e18` amount is paid as `1e18` USDC units = 1e12 USDC.
**How found:** Code review of setRewards noting it permits changing the token while pending rewards remain denominated in the old token's units; reasoned through a DAI->USDC decimal mismatch example.
**Exploitation:** A holder waits until the reward token is switched to a lower-decimal or more valuable token, then claims the old numeric amount in the new token, extracting far more value than owed.
**Insight:** When a contract stores reward/debt amounts as bare numbers, check whether the denomination token can be swapped; decimal or value changes silently reinterpret stored balances.