# Pledge may be out of reward due to the decay in veCRV balance. targetVotes is never reached.

WardenPledge computes reward from votesDifference at creation, but veCRV balance decays over the pledge duration, so boosters drain the pool before targetVotes is reached.

- Payout: Audit contest
- Severity: medium
- Program: Paladin
- Found by: Chom
- Disclosed: 2023-01-06
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-paladin#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-paladin%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:reward-distribution

**Target:** WardenPledge.sol pledge creation and boost reward accounting
**Root cause:** votesDifference is snapshotted at pledge creation using votingEscrow.balanceOf(receiver), but veCRV balance decays linearly over time, so the receiver's actual votes at boost time are lower than assumed and the reward pool is sized for too few votes.
**Steps:**
1. Create pledge with targetVotes=100 while receiver balance=20; votesDifference=80 and reward is funded for 80 votes via `vars.votesDifference = targetVotes - votingEscrow.balanceOf(receiver)`
2. Wait one week; receiver's veCRV balance decays to 10
3. Booster boosts 80 votes and claims rewards computed as `totalDelegatedAmount = ((bias * boostDuration) + bias) / 2`
4. Active votes are only 80+10=90, below targetVotes=100, and the reward pool is exhausted
5. A second booster attempting to boost the remaining 10 votes reverts with `Errors.RewardsBalanceTooLow`
**How found:** Reading Curve veCRV docs on linear decay and comparing the creation-time votesDifference snapshot against the boost-time reward accounting, noticing the receiver balance used is stale.
**Exploitation:** A booster takes the full reward pool by delegating the originally computed votesDifference while the receiver's decayed balance means the pledge target is never actually met; the receiver pays rewards but gets fewer votes than promised.
**Insight:** When reward sizing depends on a time-decaying on-chain balance (veCRV, veToken locks), check whether the snapshot at creation is reused at claim time; decay between the two makes the funded amount diverge from the actual votes delivered.