# Temporary DOS by calling notifyRewardAmount() in Bribe/Gauge with malicious tokens

Anyone can add a malicious reward token via notifyRewardAmount; its reverting transfer bricks deliverBribes, blocking Voter.distribute and Gauge.getReward for that gauge.

- Payout: Contest reward
- Severity: medium
- Program: Velodrome Finance
- Credited: unforgiven
- Disclosed: 2022-08-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-velodrome-findings/issues/138
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** Bribe/Gauge reward distribution contracts
**Root cause:** notifyRewardAmount is permissionless and pushes arbitrary tokens into the rewards array; deliverBribes iterates all reward tokens and a single reverting transfer reverts the whole loop.
**Steps:**
1. Call `Bribe.notifyRewardAmount(maliciousToken, amount)` with a token whose `transfer`/`transferFrom` reverts on the deliver path.
2. Token is appended to `rewards` and registered via `IGauge(gauge).addBribeRewardToken(token)`.
3. When `Gauge.deliverBribes()` loops `sb.deliverReward(token, bribeStart)`, the malicious token reverts the entire tx.
4. `Voter.distribute()` calls `deliverBribes()`, so it reverts; `Gauge.getReward()` calls `distribute()`, so it reverts too.
5. All bribe claims and reward distribution for that gauge are blocked until team calls `swapOutRewardToken`/`swapOutBribeRewardToken`.
**How found:** Code reading of the permissionless notifyRewardAmount and the unbounded loop in deliverBribes that transfers every registered reward token; noted a single failing transfer reverts the whole call chain up through Voter.distribute and Gauge.getReward.
**Exploitation:** Attacker deposits a tiny amount of a reverting/malicious ERC20 as a bribe; every subsequent deliverBribes/distribute/getReward call for that gauge reverts, denying all users their bribes and emissions until governance swaps the token out.
**Insight:** When a permissionless function appends user-supplied addresses to a list that is later iterated with external calls, one reverting entry bricks the whole loop; check every push-to-array path for unvetted tokens.