# FSDVesting: Claiming tributes should call FSD token's corresponding functions

FSDVesting's claimTribute and claimGovernanceTribute transfer rewards to beneficiaries without calling FSD token's claim functions, draining the vesting contract's accrued tribute.

- Payout: Audit contest
- Severity: high
- Program: FairSide
- Found by: hickuphh3
- Disclosed: 2021-12-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-fairside-findings/issues/28
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-fairside%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** FSDVesting vesting contract (Solidity)
**Root cause:** claimTribute()/claimGovernanceTribute() read available tribute and safeTransfer it to the beneficiary but never invoke fsd.claimTribute()/fsd.claimGovernanceTribute(), so the FSD token contract's internal claimed-state is never updated and rewards are paid from the vesting contract's balance instead of being replenished.
**Steps:**
1. Deploy/observe FSDVesting holding FSD tokens and a beneficiary with vested tokens accruing staking/governance tribute.
2. Beneficiary calls `claimTribute(num)`; contract reads `fsd.availableTribute(num)` and `fsd.safeTransfer(msg.sender, tribute)`.
3. Note no call to `fsd.claimTribute(num)` occurs, so FSD token's claimed accounting is untouched.
4. Repeat claims / compare against EOA flow: rewards leave the vesting contract without the corresponding FSD token claim, depleting its balance.
**How found:** Code review comparing the vesting contract's claim path against the standard EOA claim flow on the FSD token, noticing the missing external claim call before the transfer.
**Exploitation:** A beneficiary repeatedly claims tribute through the vesting contract; each claim transfers accrued rewards out of FSDVesting while the FSD token contract still considers the tribute unclaimed, so the vesting contract's token balance is drained and other beneficiaries' rewards are impaired.
**Insight:** When a wrapper/vesting contract mirrors a token's user-facing claim function, diff its call sequence against the token's own claim path; a missing state-mutating call before transfer means the wrapper pays out from its own balance while the token's accounting stays stale.