# Rewards will be locked if user transfer directly to pool without using deposit function 

LPFarming uses lpToken.balanceOf for pool supply, so a direct LP transfer inflates supply and locks part of rewards forever.

- Payout: Audit contest
- Severity: medium
- Program: JPEG'd
- Credited: TrungOre
- Disclosed: 2022-06-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-jpegd-findings/issues/19
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** LPFarming.sol staking/reward contract
**Root cause:** Pool total LP supply is derived from pool.lpToken.balanceOf(address(this)) instead of an internal accounting variable, so tokens transferred directly to the contract are counted as staked supply.
**Steps:**
1. Deploy farming with lpToken pool; attacker transfers 100 LP directly to farming address (no deposit call)
2. Add pool via `farming.add(10, lpToken)`; start epoch with `newEpoch(start, end, 100)`
3. Alice calls `farming.deposit(0, 100)`; contract sees balanceOf = 200 LP
4. Advance past epoch end; `pendingReward(0, alice)` returns 500 instead of 1000, remaining 500 locked forever
**How found:** Code reading of reward accounting: noticed total supply sourced from token balanceOf rather than tracked deposits, hypothesized direct transfers would skew distribution, confirmed with a Hardhat test.
**Exploitation:** Attacker (or any user) sends LP tokens directly to the farm contract; balanceOf-based supply inflates, diluting honest depositors' reward share and stranding undistributed rewards in the contract.
**Insight:** When a staking contract derives total staked supply from token.balanceOf, check whether unsolicited transfers (donations) can inflate the denominator and dilute or strand rewards; test with direct transfers bypassing deposit.