# bEth Rewards May Be Depleted By Flashloans or Whales

bEth reward index updates let a flashloan-funded whale briefly hold most of total balance and capture a disproportionate share of pushed rewards.

- Payout: Audit contest
- Severity: medium
- Program: Anchor
- Found by: BondiPestControl
- Disclosed: 2023-01-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-anchor-findings/issues/24
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-anchor%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** CosmWasm bEth reward contract (anchor_beth_reward)
**Root cause:** update_global_index distributes rewards proportional to instantaneous balance vs total_balance with no time-weighting or per-block cap, so a balance spike right before a reward push captures outsized share.
**Steps:**
1. Flashloan or buy a large amount of wormhole ETH
2. Convert to bEth via `anchor_beth_converter`
3. Trigger reward push to `anchor_beth_reward` so `update_global_index()` credits global_index against inflated total_balance share
4. Call `anchor_beth_rewards::execute_claim_rewards()`
5. Convert bEth back to wormhole ETH
6. Repay flashloan or sell wormhole ETH
**How found:** Code reading of update_global_index in user.rs: rewards are split by instantaneous balance share with no time-weighting, suggesting a balance-spike sandwich around reward pushes.
**Exploitation:** Attacker temporarily controls a large fraction of bEth total_balance, so the claimed_rewards/total_balance ratio credits them a disproportionate global_index increment; they claim, unwind to wormhole ETH, and repay, netting rewards without sustained stake.
**Insight:** When reward accrual uses instantaneous balance ratios, look for a way to inflate balance just before the reward-push transaction and unwind after—flashloans make this capital-free.