# Position doesn't distribute rewards to users

Rubicon's Position contract holds cTokens from Compound V2 but never calls claimComp, so supplier rewards accrue unclaimed and are lost to position owners.

- Payout: Contest reward
- Severity: high
- Program: Rubicon
- Credited: Ruhum
- Disclosed: 2025-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-rubicon-findings/issues/1021
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:business-logic vuln:reward-distribution

**Target:** Position.sol / Compound V2 cToken rewards
**Root cause:** Position supplies and borrows via Compound markets, so cTokens (and COMP rewards) accrue to the Position contract, but it never calls comptroller.claimComp() nor forwards rewards to position owners.
**Steps:**
1. Open a position via Position that calls _supply -> CErc20.mint, minting cTokens to the Position contract
2. Comptroller.mintAllowed -> distributeSupplierComp accrues COMP rewards to Position address
3. Position never calls claimComp(), so rewards stay unclaimed
4. Position owner receives no yield; other market users' rewards are diluted
**How found:** Code reading: noticed Position holds cTokens and BathHouseV2 has claimRewards/claimComp but Position lacks any claimComp call, so rewards accrue to the contract and are never distributed.
**Insight:** When a protocol contract holds yield-bearing tokens (cTokens/aTokens) on behalf of users, check whether the reward-claiming path (claimComp/claim) is actually invoked and routed to the beneficiary, not just present elsewhere in the codebase.