# The tier reserved rate is not validated and can surpass JBConstants.MAX_RESERVED_RATE

Unvalidated tier reservedRate above MAX_RESERVED_RATE inflates total redemption weight, diluting users' reclaimAmount to near-zero on redeem.

- Payout: Contest reward
- Severity: medium
- Program: Juicebox
- Credited: berndartmueller
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-juicebox-findings/issues/201
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** JBTiered721DelegateStore / JB721Delegate redemption logic (Solidity)
**Root cause:** recordAddTiers does not cap reservedRate at JBConstants.MAX_RESERVED_RATE; _numberOfReservedTokensOutstandingFor multiplies by reservedRate and divides by 10_000, so an oversized rate yields up to ~6x inflated outstanding reserved tokens.
**Steps:**
1. Owner calls recordAddTiers with reservedRate > 10_000 (up to uint16 max 65535).
2. Mint enough non-reserve NFTs so _numberOfReservedTokensOutstandingFor returns inflated outstanding count.
3. totalRedemptionWeight sums contributionFloor*quantity + inflated reserved count, inflating _total.
4. User redeems via redeemParams; _base = mulDiv(overflow, _redemptionWeight, _total) rounds down, potentially to 0.
5. NFTs burned, user receives little or no reclaimAmount.
**How found:** Code reading of _numberOfReservedTokensOutstandingFor noticed the manual uint16 cast of reservedRate and division by MAX_RESERVED_RATE without an upper-bound check in recordAddTiers, then traced the value into totalRedemptionWeight and redeemParams.
**Exploitation:** Malicious/negligent NFT contract owner sets an oversized reservedRate on a tier and mints NFTs to satisfy the outstanding-reserved conditions, inflating totalRedemptionWeight so that any redeemer's proportional reclaimAmount is diluted toward zero while their NFTs are still burned.
**Insight:** When a rate/percentage is cast to a narrower uint and divided by a constant denominator, check whether the setter enforces the denominator as an upper bound; an unchecked rate silently inflates derived accounting values used as divisors in share math.