# Treasury cannot claim COMP tokens & COMP tokens are stuck

Anyone can call Compound's claimComp on Notional's TreasuryAction, stranding claimed COMP in the contract so the treasury's own claim transfers zero and COMP is stuck.

- Payout: Audit contest
- Severity: high
- Program: Notional
- Found by: cmichel
- Disclosed: 2022-03-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-notional-findings/issues/192
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** TreasuryAction.claimCOMPAndTransfer (Solidity contract)
**Root cause:** claimCOMPAndTransfer measures COMP claimed via balanceAfter-balanceBefore, but Compound's claimComp is permissionless, so an attacker can pre-claim COMP to the contract, making the delta zero and leaving the COMP stuck.
**Steps:**
1. Attacker calls `COMPTROLLER.claimComp(address(TreasuryAction), cTokens)` directly, sending COMP to the TreasuryAction contract.
2. TreasuryAction's COMP balance now includes attacker-claimed tokens.
3. When manager calls `claimCOMPAndTransfer(cTokens)`, balanceBefore already includes the COMP, claimComp adds nothing, amountClaimed=0, safeTransfer sends 0.
4. COMP remains stuck in the contract; treasury cannot harvest it.
**How found:** Code review of claimCOMPAndTransfer's balance-snapshot pattern combined with knowledge that Compound's claimComp is callable by anyone for any account.
**Exploitation:** Permissionless claimComp lets any address trigger COMP accrual to the TreasuryAction contract; the pre/post balance accounting then zeroes out the legitimate harvest, denying the treasury its COMP (DoS/griefing). Attacker gains nothing directly.
**Insight:** When a contract measures 'amount received' via before/after balances of a token that third parties can push in permissionlessly (claimComp, airdrops, direct transfers), the delta can be griefed to zero; check for permissionless accrual functions on integrated protocols.