# Vault creator can prevent users from claiming staking rewards

Escrow feeRecipient set to zero address makes safeTransfer revert, blocking all staking reward claims; vault creator can toggle fees to control when users can claim.

- Payout: Contest reward
- Severity: medium
- Program: Popcorn
- Credited: 0xdeadbeef0x
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/829
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** MultiRewardEscrow / MultiRewardStaking reward claim flow
**Root cause:** MultiRewardEscrow constructor accepts feeRecipient without validating it is non-zero; when fees[token].feePerc > 0, lock() calls token.safeTransfer(feeRecipient, fee) which reverts on address(0), reverting the whole claimRewards call.
**Steps:**
1. Deploy MultiRewardEscrow with feeRecipient = address(0)
2. Call escrow.setFees(tokens, [1e16]) to set a non-zero fee percentage
3. Add reward token via staking.addRewardToken(...) with escrow enabled
4. User deposits staking tokens and accrues rewards
5. User calls staking.claimRewards(user, rewardTokens)
6. _lockToken -> escrow.lock -> safeTransfer(address(0), fee) reverts, blocking claim
**How found:** Code review of claimRewards -> _lockToken -> escrow.lock path, noticing feeRecipient is set in constructor without validation and safeTransfer to zero address reverts.
**Exploitation:** Vault creator sets feeRecipient to zero and a non-zero fee percentage, presenting attractive APY/low fees to lure stakers. Claims revert while users are staked. Creator later calls setFees to zero (bypassing fee transfer), and when only the creator remains staked, claims all rewards to himself.
**Insight:** When auditing escrow/fee-splitting flows, check every address used as a transfer recipient (feeRecipient, treasury, owner) for zero-address validation at construction and whether a privileged setter can toggle the code path to grief users.