# User can forfeit other user rewards

ExtraRewardsDistributor.getReward lets anyone claim for another account with an arbitrary _startIndex, skipping earlier epochs and permanently forfeiting those rewards.

- Payout: Contest reward
- Severity: high
- Program: Aura Finance
- Credited: csanuragjain
- Disclosed: 2022-07-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-aura-findings/issues/50
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-aura%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** ExtraRewardsDistributor.getReward / _allClaimableRewards (Solidity contract)
**Root cause:** getReward accepts an arbitrary _startIndex and _allClaimableRewards uses max(_startIndex,0) as the starting epoch, then writes the resulting epoch index into userClaims, marking skipped epochs as already claimed.
**Steps:**
1. Victim User B has userClaims[_token][UserB]=0 (no rewards claimed).
2. Attacker calls `getReward(_account=UserB, _startIndex=5)` on ExtraRewardsDistributor.
3. _allClaimableRewards computes epochIndex = 5>0?5:0 = 5.
4. With tokenEpochs=10 and latestEpoch=8, rewards computed only for epochs 5-7, returns index 7.
5. _getReward sets userClaims[_token][UserB]=7, so epochs 0-4 are permanently unclaimable.
**How found:** Code reading of getReward/_allClaimableRewards: noticed _startIndex is caller-supplied and directly used as the epoch lower bound while the returned index is persisted as claimed.
**Exploitation:** Any caller invokes getReward on behalf of a victim with a nonzero _startIndex, advancing the victim's claim pointer past unclaimed epochs; repeatable across users to forfeit protocol-wide reward distributions.
**Escalation:** Attacker can grief all users across the protocol by front-running claims with high _startIndex values.
**Insight:** When a claim function accepts a caller-supplied starting index/cursor and persists the resulting cursor, check whether a third party can pass an inflated cursor for another account to skip unclaimed ranges.