# MasterChef.sol Users won't be able to receive the concur rewards

MasterChef.deposit() records amounts but never transfers depositToken, so balanceOf(this) is always 0 and updatePool() returns early, yielding zero Concur rewards.

- Payout: Audit contest
- Severity: high
- Program: Concur Finance
- Found by: WatchPug
- Disclosed: 2022-05-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-concur-findings/issues/200
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-08
- Tags: domain:web3 kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** MasterChef staking/rewards contract (Solidity)
**Root cause:** deposit() only updates accounting state and never pulls depositToken from the user, so the contract's token balance stays zero. updatePool() derives lpSupply from balanceOf(address(this)), which is always 0, causing an early return before accConcurPerShare is updated.
**Steps:**
1. Read deposit() at MasterChef.sol#L157-L180: it updates user/pool accounting but contains no transferFrom of depositToken.
2. Read updatePool() at L135-L154: `lpSupply = pool.depositToken.balanceOf(address(this))`.
3. Since no tokens were ever transferred in, lpSupply == 0, hitting `if (lpSupply == 0 || pool.allocPoint == 0) { pool.lastRewardBlock = block.number; return; }`.
4. Call deposit() then updatePool()/harvest: accConcurPerShare never increases, so pending Concur rewards remain 0.
**How found:** Cross-checked the README's stated MasterChef behavior against the deposit() implementation, noticed no token transfer occurred, then traced how updatePool() sources lpSupply from the contract's own balance and concluded it would always be zero.
**Insight:** When a staking contract computes share price from `token.balanceOf(address(this))`, verify the deposit path actually moves that token into the contract; designs where tokens sit in a separate depositor contract must query that contract's supply instead of self-balance.