# BathBuddy rewards DoS

BathBuddy reward math rounds to zero for small LPs; attacker calls getReward every block to reset lastUpdateTime and block their yield indefinitely.

- Payout: Contest reward
- Severity: medium
- Program: Rubicon
- Credited: Tricko
- Disclosed: 2025-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-rubicon-findings/issues/854
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-16
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:dos vuln:precision-loss

**Target:** BathBuddy rewards contract (Solidity)
**Root cause:** rewardPerToken divides by totalSupply and multiplies by elapsed time; frequent updates make per-call increments tiny, and earned() rounds down to zero for small bathToken balances.
**Steps:**
1. Deploy BathBuddy with reward token and notifyRewardAmount.
2. Alice mints small bathToken amount (10), Eve mints large amount (10000).
3. Eve calls bathHouse.claimRewards([buddy],[stable]) to refresh lastUpdateTime each block.
4. Alice calls claimRewards; earned() computes balanceOf(account)*delta/1e18 which rounds to 0.
5. Repeat: Alice's reward balance never increases.
**How found:** Code reading of earned()/rewardPerToken(): noticed integer division by totalSupply and rounding down, hypothesized that frequent updates shrink per-call reward increments below 1 wei for small balances; confirmed with Hardhat PoC.
**Exploitation:** Attacker (large LP) repeatedly calls getReward/claimRewards at short intervals (every block on Optimism, ~2s) to keep lastUpdateTime fresh; each interval's rewardPerToken increment is so small that small LPs' earned() truncates to zero, denying them yield indefinitely at low L2 gas cost.
**Insight:** In reward-per-token accumulator designs, check whether an attacker can call the update function frequently enough that delta*rate/totalSupply truncates to zero for small stakers; L2 low gas makes this griefing cheap.