# TributeAccrual.availableTribute() & TributeAccrual.availableGovernanceTribute() Distributes Tributes Unfairly

Stale conviction scores let early claimers over-claim tribute shares, draining more tokens than the tribute pool holds.

- Payout: Audit contest
- Severity: medium
- Program: FairSide
- Found by: leastwood
- Disclosed: 2021-12-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-fairside-findings/issues/104
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-fairside%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TributeAccrual / ERC20ConvictionScore Solidity contracts
**Root cause:** availableTribute() divides by totalCS computed from per-user conviction scores that are only refreshed on transfer or explicit updateConvictionScore(), so stale scores skew the userCS/totalCS ratio.
**Steps:**
1. Alice and Bob each have conviction score 5 at time=1.
2. Advance to time=2; Bob calls `updateConvictionScore()` making his score 5*2=10; totalCS=15.
3. Bob calls `claimTribute()` on a 15-token tribute: receives `(15*10)/15 = 10` tokens.
4. Alice updates her score and claims: receives `(15*5)/15 = 7.5` tokens.
5. Total 22.5 tokens paid out from a 15-token tribute, over-draining the contract.
**How found:** Manual code review of the tribute share formula `amount.mul(userCS).div(totalCS)` and noticing conviction scores are lazily updated, so totalCS can be stale at claim time.
**Exploitation:** Attacker front-runs others by calling updateConvictionScore() then claimTribute() to inflate their share relative to stale-score users, extracting more than their fair allocation and potentially exhausting the tribute pool so later users cannot claim.
**Insight:** When a share is computed as userScore/totalScore, check whether the denominator is lazily refreshed; any per-user score updated only on transfer or explicit call lets early claimers inflate their numerator against a stale total.