# anchor_basset_reward pending yields can be stolen

anchor_basset_reward updates holder balance before settling pending rewards, letting a depositor capture a share of yield accrued to existing holders.

- Payout: Audit contest
- Severity: medium
- Program: Anchor
- Found by: WatchPug
- Disclosed: 2023-01-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-02-anchor-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-anchor%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** CosmWasm reward contract (anchor_basset_reward) execute_increase_balance
**Root cause:** execute_increase_balance credits the new deposit to holder.balance while holder.index is still the old global_index, so rewards accrued between old and current global_index get multiplied by the inflated balance.
**Steps:**
1. Attacker bonds a large amount of asset tokens; hub mints bAsset and calls anchor_basset_reward IncreaseBalance, which sets holder.index = old state.global_index and adds amount to balance.
2. Attacker triggers UpdateGlobalIndex on anchor_basset_hub, which calls execute_update_global_index() and raises global_index for all users.
3. Reward calculation now applies (current_global_index - holder.index) to the inflated balance, giving attacker a large share of pending yield.
4. Attacker claims rewards and exits; whole flow can be one smart-contract transaction, amplified with a flash loan.
**How found:** Recognized the well-known yield-farming pattern where pending yield is not settled before new shares are issued; code-read execute_increase_balance and noted state.global_index is not updated before holder.balance += amount.
**Exploitation:** Permissionless harvest/UpdateGlobalIndex plus a large (flash-loaned) bond in the same transaction lets the attacker dilute existing holders' pending yield, then claim and exit.
**Escalation:** Amplified with flash loans and single-transaction execution via a smart contract.
**Insight:** In index-based reward accounting, check every path that mutates a holder's balance: if holder.index isn't synced to global_index first, the delta gets applied to the new balance. Compare sibling implementations (anchor_beth_reward) for the correct ordering.