# Uninitialized RocketJoeStaking.lastRewardTimestamp can inflate rJoe supply

Uninitialized lastRewardTimestamp in RocketJoeStaking lets anyone pre-seed the contract with 1 JOE to mint massive rJoe supply on first updatePool.

- Payout: Audit contest
- Severity: medium
- Program: Trader Joe
- Found by: cmichel
- Disclosed: 2022-03-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-trader-joe-findings/issues/202
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-trader-joe%3AM-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** RocketJoeStaking staking contract (Solidity)
**Root cause:** lastRewardTimestamp defaults to 0; updatePool computes multiplier = block.timestamp - lastRewardTimestamp when joeSupply > 0, so a direct JOE transfer before first updatePool makes the multiplier the full epoch timestamp, minting enormous rJoe.
**Steps:**
1. Deploy state: lastRewardTimestamp == 0, contract JOE balance == 0.
2. Attacker directly transfers 1 JOE to RocketJoeStaking (no deposit call, so updatePool not triggered).
3. Call updatePool(): joeSupply = 1 > 0, multiplier = block.timestamp - 0 = large, rJoeReward = multiplier * rJoePerSec, rJoe.mint(address(this), rJoeReward).
4. Observe inflated rJoe total supply (not distributed to users).
**How found:** Code reading of updatePool: noticed lastRewardTimestamp never initialized and joeSupply uses live balanceOf rather than tracked deposits, hypothesizing a direct transfer bypasses the joeSupply==0 guard.
**Exploitation:** Pre-seed contract with minimal JOE via direct transfer before any deposit/updatePool, then trigger updatePool to mint a huge rJoeReward to the contract, inflating rJoe total supply.
**Insight:** When a reward accumulator uses live token balanceOf as denominator and an uninitialized timestamp, a direct token transfer before first sync turns the elapsed-time multiplier into the full block.timestamp; check initialization ordering of accumulator state vs. balance-based guards.