# After the vault expires, users may still receive rewards through the StakingRewards contract

Expired insrVault tokens remain stakeable in StakingRewards when periodFinish exceeds epochEnd, letting worthless tokens drain rewards from future epochs.

- Payout: Contest reward
- Severity: medium
- Program: Y2k Finance
- Credited: cccz
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-y2k-finance-findings/issues/57
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** StakingRewards contract tied to insrVault
**Root cause:** notifyRewardAmount sets periodFinish = block.timestamp + rewardsDuration without bounding it to the vault's epochEnd, so staking continues after the vault expires and its tokens become worthless.
**Steps:**
1. Observe Controller.triggerEndEpoch sets insrVault claimTVL to 0, making insrVault tokens worthless.
2. Note StakingRewards.notifyRewardAmount sets `periodFinish = block.timestamp.add(rewardsDuration)` with no cap relative to epochEnd.
3. When periodFinish > epochEnd, stake worthless insrTokens in the insrVault StakingRewards.
4. Continue accruing rewards past vault expiry, competing with future valid epochs' stakers.
**How found:** Code reading of Controller.triggerEndEpoch (claimTVL set to 0) cross-referenced with StakingRewards.notifyRewardAmount's unbounded periodFinish, spotting that staking lifetime is not tied to vault epoch lifetime.
**Exploitation:** Attacker holds insrVault tokens after triggerEndEpoch zeroes their claim value, keeps them staked in StakingRewards whose periodFinish extends beyond epochEnd, and collects rewards that should belong to future valid epochs.
**Insight:** When a staking contract's reward period is set independently of the underlying token's expiry/epoch, check whether the token retains value after expiry; if not, expired tokens can farm rewards meant for future epochs.