# Strategy in StakerVault.sol can steal more rewards even though it's designed strategies shouldn't get rewards.

Strategy transfers staked tokens to a non-strategy address, bypassing strategy reward exclusion and inflating LpGauge poolStakedIntegral to over-claim rewards.

- Payout: Contest reward
- Severity: medium
- Program: Backd
- Credited: hansfriese
- Disclosed: 2022-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-backd-findings/issues/85
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-backd%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** StakerVault.sol / LpGauge.sol reward accounting
**Root cause:** StakerVault.transfer/transferFrom do not update strategiesTotalStaked and _poolTotalStaked when tokens move between strategy and non-strategy addresses, so LpGauge's strategy exclusion and poolStakedIntegral math are wrong.
**Steps:**
1. Strategy A stakes amount x; x added to StakerVault.strategiesTotalStaked.
2. A transfers x to non-strategy B via StakerVault.transfer; strategiesTotalStaked and _poolTotalStaked unchanged.
3. LpGauge.poolStakedIntegral grows larger than for a normal user staking same amount because poolTotalStaked is understated.
4. B (not flagged as strategy) passes LpGauge.userCheckPoint strategy check and calls LpGauge.claimRewards() to collect inflated rewards.
**How found:** Code review of StakerVault transfer paths and LpGauge reward accounting; noticed strategiesTotalStaked/_poolTotalStaked not updated on transfers and that userCheckPoint only excludes addresses flagged as strategies.
**Exploitation:** Strategy deposits, transfers staked balance to a non-strategy address, waits for poolStakedIntegral to accrue, then the non-strategy address claims rewards that strategies are meant to be excluded from; reward system overpays.
**Insight:** When a protocol excludes a class of addresses (strategies) from rewards, check whether that flag can be shed by transferring the position to an unflagged address, and whether the accounting variables used in the reward integral are updated on every balance-moving path.