# Wrong reward distribution between early and late depositors because of the late syncRewards() call in the cycle, syncReward() logic should be executed in each withdraw or deposits (without reverting)

TokenggAVAX rewards only sync when syncRewards() is called; depositors/withdrawers before the late call forfeit or misallocate cycle yield.

- Payout: Contest reward
- Severity: medium
- Program: GoGoPool
- Credited: unforgiven
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/478
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** TokenggAVAX liquid staking token contract (syncRewards/deposit/withdraw)
**Root cause:** syncRewards() is only invoked manually and reverts if called before rewardsCycleEnd; deposits/withdrawals do not trigger cycle rollover, so rewards accrued since cycle end are not reflected in share pricing until someone calls syncRewards().
**Steps:**
1. Set rewardsCycleLength=10 days, next cycle reward=100 AVAX.
2. user1 holds 10000 AVAX (50% shares); cycle ends but syncRewards() not called for 8 days.
3. user1 withdraws 10000 AVAX, receiving no rewards for 8 days of stake.
4. user2 deposits 1000 AVAX (10% shares) and calls `syncRewards()`, starting linear distribution of 100 AVAX.
5. After 2 days cycle ends; user2 collects 10 AVAX while user1 got 0 despite longer/larger stake.
**How found:** Code reading of syncRewards() linear distribution between block.timestamp and next multiple of rewardsCycleLength; noticed cycle end is fixed but call timing is manual, so pre-sync deposits/withdrawals are excluded from reward accounting.
**Insight:** For rebasing/yield-vault designs, check whether reward checkpointing is lazy/manual: any deposit or withdraw that occurs between cycle end and the next sync call is priced without pending yield, letting later actors capture yield earned by earlier stakers.