# fee loss in AutoPxGmx and AutoPxGlp and reward loss in AutoPxGlp by calling PirexRewards.claim(pxGmx/pxGpl, AutoPx*) directly which transfers rewards to  AutoPx* pool without compound logic get executed and fee calculation logic and pxGmx wouldn't be executed for those rewards

Anyone can call PirexRewards.claim(pxGmx/pxGlp, AutoPx*) directly, delivering rewards to the vault without compound() running, so protocol fees and pxGmx reward accrual are skipped.

- Payout: Contest reward
- Severity: high
- Program: Redacted Cartel
- Credited: unforgiven
- Disclosed: 2023-01-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-redactedcartel-findings/issues/321
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass vuln:reward-distribution

**Target:** AutoPxGmx/AutoPxGlp vault compound() and PirexRewards.claim()
**Root cause:** Fee and pxGmx reward accrual are computed only from balance deltas observed inside compound(); PirexRewards.claim() is permissionless and can push rewards to the vault without triggering compound(), so those rewards are never fee-charged or harvested.
**Steps:**
1. Vault AutoPxGlp has pending rewards (e.g. 100 pxGmx, 100 weth) accrued in PirexRewards.
2. Attacker calls `PirexRewards.claim(pxGmx, AutoPxGlp)` and `PirexRewards.claim(pxGlp, AutoPxGlp)` directly.
3. PirexRewards transfers the reward tokens to AutoPxGlp; vault balance increases but no compound() logic runs.
4. Later compound() call sees no new rewards (pre/post balance delta ~0), so no platform fee is taken and `_harvest()` is not called for those pxGmx rewards.
5. Owner loses fees; users lose pxGmx reward accrual for the directly-claimed rewards.
**How found:** Code review of compound()'s balance-delta accounting combined with noticing PirexRewards.claim() is externally callable for any user, so rewards can arrive without compound() observing them.
**Exploitation:** Permissionless call to PirexRewards.claim() for the vault address front-runs or pre-empts compound(), moving rewards into the vault outside the accounting path. No capital needed; repeated calls drain fee and reward accounting.
**Insight:** When a vault computes fees/rewards from before/after balance deltas inside a single function, check whether the underlying reward source can be triggered externally (permissionless claim/poke) to deliver tokens outside that function — the delta then reads zero and accounting is silently skipped.