# Griefing Attack By Extending The Reward Duration

Anyone can call Gauge.notifyRewardAmount with dust amounts during an active period, repeatedly extending the reward window and diluting reward rate for stakers.

- Payout: Contest reward
- Severity: medium
- Program: Velodrome Finance
- Credited: xiaoming90
- Disclosed: 2022-08-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-velodrome-findings/issues/172
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Gauge.notifyRewardAmount reward streaming contract
**Root cause:** notifyRewardAmount is permissionless and, when a period is active, accepts any amount greater than the remaining undistributed rewards, resetting periodFinish to adjustedTstamp + DURATION and recomputing rewardRate over the full duration.
**Steps:**
1. Observe an active reward period on Gauge for token T with periodFinish in the future.
2. Call `notifyRewardAmount(T, amount)` where amount is just above `_left = (periodFinish - now) * rewardRate[T]` (dust).
3. Contract transfers amount, sets `rewardRate[T] = (amount + _left) / DURATION`, and pushes `periodFinish[T] = adjustedTstamp + DURATION`.
4. Repeat each period to keep extending the window and diluting rewardRate.
**How found:** Code review of notifyRewardAmount noticed it lacks an access check and unconditionally resets periodFinish when a period is active; cross-referenced Curve's ChildChainStreamer docs which flag the same griefing vector.
**Exploitation:** Attacker repeatedly calls notifyRewardAmount with minimal dust during active periods; each call resets periodFinish and recomputes rewardRate over the full DURATION, stretching emissions and lowering yield for stakers. Cheap on L2 due to low gas.
**Insight:** On Synthetix-style staking rewards, check whether notifyRewardAmount is permissionless during an active period and whether periodFinish is reset rather than extended from remaining time; dust calls then dilute rewardRate.