# FlywheelCore’s setFlywheelRewards can remove access to reward funds from current users

FlywheelCore.setFlywheelRewards doesn't verify the new rewards contract points back to this FlywheelCore, permanently locking users' accrued rewards.

- Payout: Audit contest
- Severity: medium
- Program: Tribe
- Found by: hyh
- Disclosed: 2022-07-14
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-04-xtribe#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-05
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** FlywheelCore / BaseFlywheelRewards reward accounting contract
**Root cause:** setFlywheelRewards accepts any newFlywheelRewards without checking that its immutable flywheel reference equals this FlywheelCore, so the new contract never approves this core to move its funds.
**Steps:**
1. Call `setFlywheelRewards(newFlywheelRewards)` where newFlywheelRewards.flywheel != this FlywheelCore.
2. Reward funds are moved to newFlywheelRewards, but this FlywheelCore is not approved to transfer them.
3. Claiming reverts at `rewardToken.safeTransferFrom(address(flywheelRewards), ...)` (FlywheelCore.sol#L125).
4. Subsequent setFlywheelRewards also reverts at FlywheelCore.sol#L168, leaving rewardsAccrued balances non-operational.
**How found:** Code reading: noticed setFlywheelRewards lacks a check that newFlywheelRewards.flywheel == this, while BaseFlywheelRewards sets the core immutably at construction and only that core is approved for fund transfers.
**Exploitation:** Requires authorized caller (requiresAuth) to mistakenly or maliciously point to a rewards contract whose immutable flywheel is a different core; all unclaimed rewards become unclaimable and unrecoverable.
**Insight:** When a setter swaps a contract that holds funds, verify the new contract's back-reference to the caller; immutable wiring set at construction can silently break approval-based fund access.