# Unreleased locks cause the reward distribution to be flawed in BondNFT

Expired-but-unreleased bonds keep their shares in totalShares, so active bond holders receive a diluted share of each reward distribution until release.

- Payout: Contest reward
- Severity: medium
- Program: Tigris Trade
- Credited: Ruhum
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/630
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** BondNFT reward distribution contract
**Root cause:** totalShares[asset] is only decremented in release(), so expired bonds that haven't been released still count toward the denominator in distribute(), diluting rewards for active bonds.
**Steps:**
1. Owner locks 100 tokens for 100 epochs; user locks 1000 tokens for 10 epochs.
2. Call `bond.distribute(stabletoken, 1000e18)`; both bonds accrue ~500e18 pending.
3. Advance 10 days so bond 2 expires but is not released.
4. Call `bond.distribute(stabletoken, 1000e18)` again.
5. Observe bond 1 pending is less than expected 1499.99e18 because bond 2's shares remain in totalShares.
6. Call `lock.release(2)` and confirm user balance reflects the diluted amount.
**How found:** Code reading of distribute() vs release(): noticed totalShares only updated on release, hypothesized stale shares inflate the denominator, confirmed with a Foundry/Hardhat test comparing expected vs actual pending.
**Exploitation:** No attacker action needed; any expired bond left unreleased (up to 7 epochs before anyone can force release) causes all active bond holders to receive proportionally less of each distribution.
**Insight:** In share-based reward accounting, check every path that mutates the share denominator; expiry alone doesn't remove shares—only an explicit release does, so expired-but-unreleased positions silently dilute active holders.