# FeePoolV0.sol#distributeMochi() will unexpectedly flush treasuryShare, causing the protocol fee cannot be properly accounted for and collected

FeePoolV0._shareMochi() zeroes treasuryShare during distributeMochi(), letting anyone repeatedly reset and redirect protocol fees to vMochi/veCRV holders.

- Payout: Audit contest
- Severity: high
- Program: Mochi
- Found by: WatchPug
- Disclosed: 2021-11-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-mochi-findings/issues/114
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** FeePoolV0.sol fee distribution contract
**Root cause:** _shareMochi() unconditionally sets treasuryShare = 0 even though distributeMochi() only converts and distributes mochiShare, so the treasury allocation is wiped without being paid out.
**Steps:**
1. Call `distributeMochi()` — internally `_shareMochi()` sets `treasuryShare = 0` while only mochiShare is converted/sent.
2. Call `updateReserve()` to reallocate part of the (now zeroed) treasuryShare into mochiShare.
3. Call `distributeMochi()` again to send that amount to vMochi Vault and veCRV Holders.
4. Repeat until treasuryShare is drained to near zero.
**How found:** Code review of _shareMochi() noticing treasuryShare = 0 reset despite distributeMochi() never touching treasuryShare, then tracing updateReserve() to see the reset amount can be reallocated to mochiShare.
**Exploitation:** Any external caller loops distributeMochi() + updateReserve() to repeatedly flush treasuryShare into mochiShare, which is then distributed to vMochi Vault and veCRV Holders, draining protocol fees.
**Insight:** In fee-accounting contracts, check every state variable zeroed in a shared internal helper against which shares the caller actually distributes; a reset of an undistributed share lets anyone reallocate it via the reserve-update path.