# Badger rewards from Hidden Hand can permanently prevent Strategy from receiving bribes

Badger bribe claims double-transfer BADGER, so the second safeTransfer reverts and claimBribesFromHiddenHand permanently blocks all bribe collection.

- Payout: Contest reward
- Severity: medium
- Program: BadgerDAO
- Credited: scaraven
- Disclosed: 2022-08-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-badger-findings/issues/111
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** MyStrategy / BasicStrategy reward handling (Solidity contracts)
**Root cause:** _sendBadgerToTree transfers BADGER to the tree and then calls _processExtraToken, which transfers the same amount again via the Vault; the strategy holds no extra BADGER so the second safeTransfer reverts.
**Steps:**
1. Call `claimBribesFromHiddenHand()` as strategist with bribes including BADGER (e.g. 50 USDT + 50 BADGER).
2. Strategy receives BADGER, `_handleRewardTransfer()` calls `_sendBadgerToTree(amount)` which does `safeTransfer(BADGER_TREE, amount)`, dropping balance to 0.
3. `_processExtraToken(address(BADGER), amount)` then attempts a second transfer of the same amount; balance is 0 so safeTransfer reverts.
4. Whole claimBribesFromHiddenHand() reverts, blocking all future bribe claims.
**How found:** Code reading of reward-handling paths: noticed BADGER is routed both directly to the tree in MyStrategy and again through _processExtraToken in BasicStrategy, implying a double spend of the same balance.
**Insight:** When a strategy has multiple reward-routing hooks, check whether the same token is forwarded twice along two paths (direct transfer plus generic _processExtraToken) — a zero starting balance turns the duplicate into a permanent revert/DoS on the claim function.