# Rewards accumulated can stay constant and often not increment

Integer truncation in Yield's ERC20Rewards accumulator lets frequent small updates round rewards-per-token to zero while lastUpdated advances, silently forfeiting rewards.

- Payout: Audit contest
- Severity: high
- Program: Yield
- Found by: moose-code
- Disclosed: 2021-09-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-08-yield-findings/issues/65
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-yield%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** ERC20Rewards rewards accumulator (Solidity contract)
**Root cause:** accumulated += 1e18 * timeSinceLastUpdated * rate / totalSupply truncates to zero when the numerator is smaller than totalSupply, yet lastUpdated is still advanced, discarding the elapsed time's rewards.
**Steps:**
1. Note accumulator update at line 115: `1e18 * timeSinceLastUpdated * rewardsPerToken_.rate / _totalSupply`
2. Pick large totalSupply (e.g. 1e27 wei) and rate < 1e9 so the division yields 0
3. Keep timeSinceLastUpdated small (~1s) by transferring/burning tokens frequently (L2 for gas)
4. Each call adds 0 to accumulated but sets `rewardsPerToken_.lastUpdated = end`, so rewards never accrue
**How found:** Code reading of the accumulator math; observed that the division truncates and that lastUpdated is updated unconditionally even when accumulated does not change.
**Exploitation:** Attacker (or natural frequent transfers) repeatedly triggers the update with tiny time deltas so the integer division rounds to zero every time; lastUpdated keeps advancing, permanently forfeiting the rewards that should have accrued to holders.
**Insight:** When an accumulator divides by totalSupply, check whether the numerator can be smaller than the denominator for realistic supply/rate values; if so, the truncation-to-zero combined with unconditional timestamp advancement silently burns rewards.