# BackingManager: rsr is distributed across all rsr revenue destinations which is a loss for rsr stakers

BackingManager routes seized RSR through rsrTrader to Distributor, which splits it across all RSR revenue destinations instead of returning it entirely to StRSR, shortchanging stakers.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: HollaDieWaldfee
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-reserve-findings/issues/276
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BackingManager.handoutExcessAssets / Distributor revenue routing
**Root cause:** handoutExcessAssets sends RSR to rsrTrader, which forwards to Distributor; Distributor splits RSR per its distribution table rather than sending all to StRSR, so seized RSR meant to repay stakers leaks to other RSR revenue destinations.
**Steps:**
1. Trigger RSR seizure from StRSR due to under-collateralization.
2. Run a trade that restores collateralization, leaving residual RSR in BackingManager.
3. Call BackingManager.manageTokens; full collateralization triggers handoutExcessAssets.
4. handoutExcessAssets transfers RSR to rsrTrader.
5. rsrTrader forwards RSR to Distributor.
6. Distributor distributes RSR across all RSR destinations, not solely StRSR.
**How found:** Code-reading of the RSR flow: traced handoutExcessAssets -> rsrTrader -> Distributor and noticed Distributor splits RSR per its table rather than returning all to StRSR, contradicting the stated intent of returning seized RSR to stakers.
**Exploitation:** No attacker action; economic misallocation where RSR seized from stakers is partially diverted to other RSR revenue destinations instead of fully returning to StRSR.
**Insight:** When a function's comment states intent (return seized RSR to StRSR), trace the full downstream call chain to the terminal distributor; intermediate routing contracts may re-split funds per their own config, breaking the stated invariant.