# Wrong reward token calculation in MasterChef contract

MasterChef.add() updates totalPoints without accruing existing pools, so adding a pool retroactively dilutes prior stakers' rewards by the new allocation ratio.

- Payout: Audit contest
- Severity: high
- Program: Concur Finance
- Found by: throttle
- Disclosed: 2022-05-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-concur-findings/issues/219
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** MasterChef staking/reward contract (Solidity)
**Root cause:** add() changes totalPoints (the reward slope) without first calling massUpdate() to accrue each existing pool's rewards at the old rate, so past accrual is recomputed at the new diluted rate.
**Steps:**
1. Deploy MasterChef; owner calls `add(tokenA, 100, fee, startBlock)` -> totalPoints=100.
2. Alice stakes 10 tokens; wait 1 week.
3. Owner calls `add(tokenB, 100, fee, startBlock)` -> totalPoints=200 without massUpdate.
4. Alice withdraws/claims: reward computed at 100/200 instead of 100/100, receiving ~half of earned rewards.
**How found:** Code review of add(): noticed totalPoints mutated without updating per-pool reward debt, and that massUpdate() existed but was never called.
**Exploitation:** No attacker capital needed; any pool addition by owner retroactively reduces accrued rewards of existing stakers, breaking protocol accounting and underpaying users.
**Insight:** In MasterChef-style contracts, any function mutating totalAllocPoint (add/set) must accrue all pools first; grep for totalAllocPoint writes lacking massUpdate to find reward-dilution bugs.