# Gauge Rewards Stuck In VoterProxy Contract When ExtraRewardStashV3 Is Used Within Angle Deployment

Angle gauges return veAsset and extra rewards from one claim_rewards call, so VoterProxy.claimVeAsset sweeps only ANGLE and strands DAI/WETH rewards permanently in VoterProxy.

- Payout: Contest reward
- Severity: high
- Program: veToken Finance
- Credited: xiaoming90
- Disclosed: 2022-10-25
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-05-vetoken-findings/issues/209
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-vetoken%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Booster._earmarkRewards / VoterProxy.claimVeAsset with Angle LiquidityGaugeV4 and ExtraRewardStashV3
**Root cause:** VoterProxy.claimVeAsset assumes gauge claim returns only veAsset, but Angle's LiquidityGaugeV4.claim_rewards returns all reward tokens at once; only veAsset is transferred out, leaving other tokens stranded with no sweep function.
**Steps:**
1. Configure Angle pool with gauge having reward_tokens(0)=ANGLE, reward_tokens(1)=DAI, stash=ExtraRewardStashV3, no gauge redirect set.
2. Call `Booster._earmarkRewards(pid)`.
3. First: `VoterProxy.claimVeAsset(gauge)` calls `IGauge(gauge).claim_rewards()`, receiving 100 ANGLE + 100 DAI into VoterProxy.
4. VoterProxy transfers only `IERC20(veAsset).balanceOf(this)` (ANGLE) to Booster; DAI remains in VoterProxy.
5. Second: `ExtraRewardStashV3.claimRewards()` sets gauge redirect then calls `Booster.claimRewards`, but gauge already drained so stash receives nothing; `processStash` distributes nothing.
6. DAI stays locked in VoterProxy with no sweep path.
**How found:** Compared reward-claiming flows across Curve, IDLE and Angle integrations: noticed Angle's LiquidityGaugeV4.claim_rewards returns both veAsset and extra rewards in one call, while Booster._earmarkRewards calls claimVeAsset first and only forwards veAsset, then relies on the stash to claim extras a second time.
**Exploitation:** Not an attacker-driven exploit; occurs on every earmark for Angle pools, permanently stranding non-veAsset gauge rewards in VoterProxy where no function can recover them.
**Insight:** When integrating a new protocol's gauge, verify whether veAsset and extra rewards share one claim function; if so, the stash must be the sole claimer (with redirect set at deployment), otherwise the first claimer strands the non-veAsset tokens.