# Bribe Rewards Not Collected In Current Period Will Be Lost Forever

Velodrome Bribe rewards keyed per-epoch are only deliverable in the current epoch; if Voter.distribute is never called, unclaimed bribes are lost forever.

- Payout: Contest reward
- Severity: medium
- Program: Velodrome Finance
- Credited: xiaoming90
- Disclosed: 2022-08-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-velodrome-findings/issues/171
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Bribe/Gauge bribe reward distribution contracts
**Root cause:** Bribe rewards are stored in tokenRewardsPerEpoch keyed to a single epoch, and Gauge.deliverBribes only computes bribeStart for the current epoch, so prior epochs' rewards are never accrued forward or retrievable.
**Steps:**
1. Briber calls `Bribe.notifyRewardAmount(DAI, 100e18)` in epoch 0; stored at `tokenRewardsPerEpoch[DAI][epoch0Start]`.
2. No one calls `Voter.distribute()` during epoch 0.
3. In epoch 1, `Gauge.deliverBribes()` computes `bribeStart = block.timestamp - (block.timestamp % 7 days) + 1 days`, i.e. epoch 1 start, and reads only that epoch's mapping entry.
4. Epoch 0's 100 DAI entry is never read; funds remain stuck in Bribe contract permanently.
**How found:** Code reading of notifyRewardAmount and deliverBribes revealed rewards are keyed per-epoch while delivery only ever queries the current epoch's key, implying no path to recover skipped epochs.
**Insight:** When rewards/accruals are stored in per-epoch (or per-period) mappings, check whether the claim/distribute function can address past period keys; a single current-period lookup means any skipped distribution permanently strands funds.