# auraBAL can be stuck into the Strategy contract

auraBAL rewards sent to Badger's Strategy outside _harvest are not counted by the balance-delta logic and become permanently stuck, since auraBAL is a protected token.

- Payout: Contest reward
- Severity: high
- Program: BadgerDAO
- Credited: PumpkingWok
- Disclosed: 2022-08-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-badger-findings/issues/129
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** MyStrategy.sol harvest/claim reward accounting
**Root cause:** _harvest and claimBribesFromHiddenHand compute earned rewards as a before/after balance delta, so tokens transferred to the strategy outside those calls are never recognized as earned and never swapped.
**Steps:**
1. Call LOCKER.getReward(strategy) directly as any address; auraBAL is transferred to the strategy.
2. Next _harvest measures balance delta only across its own getReward call, so the pre-existing auraBAL is excluded.
3. auraBAL is a protected token and cannot be swept, so it stays stuck.
4. Same applies to frontrunning hiddenHandDistributor.claim(_claims) for the strategy, skipping _notifyBribesProcessor.
**How found:** Code review of _harvest's balance-before/after claim accounting combined with the observation that getReward is public and callable for any address, plus auraBAL being a protected (non-sweepable) token.
**Exploitation:** Any address calls the public LOCKER.getReward(strategy) (or frontruns claimBribesFromHiddenHand by calling hiddenHandDistributor.claim for the strategy), depositing auraBAL that the delta-based harvest ignores; the funds are stranded because auraBAL is protected from sweeping.
**Insight:** When reward accounting uses before/after balance deltas, check whether the claim function is publicly callable for the contract's address; a third party can pre-claim and desync the delta, stranding protected tokens.