# Wrong calculation for the new rewardRate[token] can cause some of the late users can not get their rewards

Gauge.notifyRewardAmount divides rewards by DURATION (5 days) while periodFinish extends to the next bribe period, overpaying early claimers and leaving late claimers unable to withdraw.

- Payout: Contest reward
- Severity: medium
- Program: Velodrome Finance
- Credited: WatchPug
- Disclosed: 2022-08-08
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-05-velodrome-findings/issues/186
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Gauge.sol notifyRewardAmount / rewardPerToken reward accounting
**Root cause:** rewardRate[token] is computed as amount/DURATION (5 days) but periodFinish is set to adjustedTstamp+7 days, so rewards are emitted faster than the actual reward period, inflating rewardPerToken and draining the balance before all users claim.
**Steps:**
1. Alice and Bob each stake 1,000 tokens at t=1653091200.
2. Admin calls `notifyRewardAmount(DAI, 1000e18)` at t=1653100000; bribeStart=1653004800, adjustedTstamp=1653609600, periodFinish=1654041600, rewardRate=1000e18/432000.
3. Alice calls `getReward()` at t=1654041800 and receives ~1,000 DAI (rewardPerTokenStored ~1e18).
4. Bob calls `getReward()`; transfer reverts due to insufficient gauge balance.
**How found:** Code reading of notifyRewardAmount: noticed rewardRate divides by DURATION (5 days) while periodFinish is derived from adjustedTstamp (7-day bribe period), a mismatch between emission rate and period length; traced rewardPerToken to confirm over-accrual.
**Exploitation:** Any user who claims near periodFinish receives the full inflated rewardPerToken accrual; later claimers' transfers revert because the gauge's token balance is exhausted. No capital needed beyond staking; attacker just claims early.
**Insight:** When a staking contract sets an emission rate and a period end from different constants, check that rate*period equals the funded amount; a 5-day DURATION vs 7-day bribe window silently over-emits and the last claimers' transfers revert on insufficient balance.