# Reserved token rounding can be abused to honeypot and steal user's funds

Juicebox rounds reserved-token minting up to 1 per untouched tier, letting a project honeypot mint and redeem reserves to steal most of a victim's contribution.

- Payout: Contest reward
- Severity: high
- Program: Juicebox
- Credited: Trust
- Disclosed: 2023-01-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-10-juicebox-findings/issues/191
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Juicebox DelegateStore mintReservesFor / reserved token accounting
**Root cause:** When no tokens minted yet for a tier, _numberOfReservedTokensOutstandingFor returns 1 (round up) regardless of reserve rate, so a 1% reserve rate still yields a full reserve token per tier.
**Steps:**
1. Launch project with 10 tiers of contributions 1000,1050,...,1900 and reserve rate 1%, redemption rate 100%.
2. Victim contributes 1100 and receives Tier 3 NFT.
3. Project calls mintReservesFor for Tier 1,2,4..10, each returning 1 reserve token due to `initialQuantity == remainingQuantity` round-up.
4. Project redeems all reserve tokens; total weight 12250, reserve weight 11150.
5. Project cashes out 1100 * 11150/12250 ≈ 1001 tokens, draining victim's contribution.
**How found:** Code reading of DelegateStore._numberOfReservedTokensOutstandingFor; noticed the round-up-to-1 branch triggers whenever initialQuantity equals remainingQuantity, independent of reserve rate.
**Exploitation:** Project owner mints one reserve token per untouched tier via the round-up branch, then redeems them at 100% redemption rate to extract ~91% of the victim's contribution without investing capital.
**Escalation:** Bypasses lockReservedTokenChanges/lockManualMintingChanges safeguards and user voting/funding-cycle delays, so victim cannot withdraw in time.
**Insight:** Rounding-up branches that guarantee a minimum mintable amount can be weaponized when combined with redemption math: check whether a tiny reserve rate still yields a full unit per tier and whether redemption weight dilutes honest contributors.