# Rewards delay release could cause yields steal and loss

Frax xERC4626 syncRewards delays yield release, letting a user time deposit/redeem around syncRewards to capture other users' pending staking yield.

- Payout: Contest reward
- Severity: medium
- Program: Frax Finance
- Credited: \_\_141345\_\_
- Disclosed: 2022-11-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-frax-findings/issues/110
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-frax%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** ERC4626 vault (xERC4626.sol) rewards accounting
**Root cause:** syncRewards splits balance into storedTotalAssets and lastRewardAmount, releasing the latter linearly over the next cycle; deposit/redeem price shares off totalAssets() which excludes not-yet-synced yield, so timing around syncRewards misprices shares.
**Steps:**
1. Observe pending yield sitting in vault balance not yet synced (e.g. mempool `withdraw(10,000)` from victim, or treasury transfers accumulated over cycles).
2. Front-run with `syncRewards()` so recent yield becomes `lastRewardAmount` and is excluded from `totalAssets()`.
3. `deposit(10,000)` to mint shares priced without that yield.
4. Wait one rewards cycle for linear unlock into `totalAssets()`.
5. `redeem()` shares to capture the yield that belonged to prior holders.
**How found:** Code reading of syncRewards/totalAssets accounting: noticed totalAssets() excludes lastRewardAmount until linearly unlocked, and deposit/redeem use it for pricing, implying a timing gap exploitable around syncRewards.
**Exploitation:** Attacker watches mempool for a large withdraw or accumulated treasury yield, calls syncRewards to lock yield out of share price, deposits at the deflated price, waits a cycle, then redeems to absorb the yield (~60 of 70 in example) at victims' expense.
**Insight:** In ERC4626-style vaults, check whether yield is recognized in totalAssets() at the moment of deposit/redeem; any window where pending rewards are excluded from share price is a front-runnable yield-capture surface, especially around manual sync functions.