# ConcentratedLiquidityPoolManager's incentives can be stolen

reclaimIncentive in Sushi's ConcentratedLiquidityPoolManager never decrements rewardsUnclaimed, letting anyone repeatedly reclaim and drain all incentive tokens.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: cmichel
- Disclosed: 2021-11-30
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-2-findings/issues/37
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ConcentratedLiquidityPoolManager incentive contract
**Root cause:** reclaimIncentive pays out incentive.rewardsUnclaimed but never reduces the field, so the same unclaimed balance can be withdrawn repeatedly. All incentives share one token balance in the contract.
**Steps:**
1. Create an incentive with `pool` set to a random/non-existent address so no one else can claim, choosing `incentive.token` = victim token (WETH/USDC/SUSHI) and startTime/endTime/expiry passing checks (expire in ~5 weeks).
2. Set non-zero `rewardsUnclaimed` and transfer that amount of `incentive.token` to the PoolManager.
3. Wait until expiry.
4. Call `reclaimIncentive(pool, incentiveId, amount=incentive.rewardsUnclaimed, attacker, false)` repeatedly; rewardsUnclaimed is never decremented, draining the shared balance.
**How found:** Code review of reclaimIncentive noticed the missing decrement of incentive.rewardsUnclaimed combined with all incentives sharing one contract token balance, implying repeat-claim drain.
**Exploitation:** Attacker seeds a self-owned expired incentive with a small rewardsUnclaimed, then loops reclaimIncentive to withdraw the same amount many times, draining all tokens held for every incentive in the shared PoolManager balance.
**Insight:** When multiple incentive/reward records share a single token balance, check every payout path decrements its accounting field; a self-created expired incentive with a non-existent pool isolates rewardsUnclaimed so the repeat-claim loop is uncontested.