# StakingRewards.sol#notifyRewardAmount() Improper reward balance checks can make some users unable to withdraw their rewards

StakingRewards.notifyRewardAmount checks only total token balance, so re-notifying rewards without funding lets earned rewards exceed balance and users' getReward reverts.

- Payout: Audit contest
- Severity: medium
- Program: Concur Finance
- Found by: WatchPug
- Disclosed: 2022-05-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-concur-findings/issues/209
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AM-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** StakingRewards.sol notifyRewardAmount reward accounting
**Root cause:** notifyRewardAmount validates rewardRate against the contract's full rewardsToken balance, which includes already-earned-but-unclaimed user rewards, so it can overcommit rewards that aren't actually funded.
**Steps:**
1. Set rewardsDuration = 7 days.
2. Alice stakes 1,000 stakingToken.
3. rewardsDistribution sends 100 rewardsToken and calls `notifyRewardAmount(100)`.
4. After 7 days Alice's `earned()` = 100 but she does not call `getReward()`.
5. rewardsDistribution calls `notifyRewardAmount(100)` again without transferring funds; tx succeeds because balance check passes.
6. After 7 more days `earned()` = 200; Alice's `getReward()` reverts on insufficient rewardsToken balance.
**How found:** Code reading of the balance check in notifyRewardAmount; observed that balanceOf includes unclaimed user rewards, so the check does not guarantee solvency for future claims.
**Exploitation:** Requires a misconfigured/erroneous rewardsDistribution call that re-notifies rewards without funding; unclaimed user rewards are double-counted, leaving the contract underfunded so later claimers cannot withdraw.
**Insight:** When auditing reward/staking accounting, check whether solvency checks use total token balance that already includes accrued-but-unclaimed user liabilities; a balance check is not a liability check.