# StakingRewards reward rate can be dragged out and diluted

StakingRewards.notifyRewardAmount rebases leftover rewards over a fresh rewardsDuration, so repeated zero-amount calls dilute rewardRate and drag payouts out.

- Payout: Contest reward
- Severity: medium
- Program: Y2k Finance
- Credited: cccz
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-y2k-finance-findings/issues/52
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** StakingRewards.notifyRewardAmount reward accounting
**Root cause:** notifyRewardAmount always recomputes rewardRate = (reward + leftover)/rewardsDuration and resets periodFinish to now+rewardsDuration, so leftover rewards get spread over a full new duration instead of the remaining time.
**Steps:**
1. Start with rewardRate=1000/rewardsDuration and 20% of duration elapsed.
2. Call `notifyRewardAmount(0)`: rewardRate becomes (0 + 800)/rewardsDuration = 800/rewardsDuration.
3. Wait another 20% of duration, call `notifyRewardAmount(0)` again: rewardRate becomes 640/rewardsDuration.
4. Repeat to geometrically dilute rewardRate toward zero and extend periodFinish indefinitely.
**How found:** Code reading of the notifyRewardAmount branch handling the case block.timestamp < periodFinish; noticed leftover is divided by full rewardsDuration rather than remaining time, and that a zero reward still triggers the rebase.
**Exploitation:** Anyone able to call notifyRewardAmount (admin/reward depositor) repeatedly submits zero-value notifications, each time rebasing remaining rewards over a fresh full rewardsDuration, cutting rewardRate by the elapsed fraction and pushing periodFinish forward, so depositors' yield is diluted and payouts dragged out.
**Insight:** In Synthetix-style StakingRewards forks, check whether notifyRewardAmount divides leftover by remaining time or by the full duration, and whether a zero/1-wei reward still resets periodFinish — both enable reward-rate dilution.