# Delegation rewards are not counted toward granting fund

Ajna StandardFunding treasury re-adds full 10% delegate-reward reserve each period even though it was paid out, inflating treasury accounting and over-granting funds.

- Payout: Contest reward
- Severity: high
- Program: Ajna Protocol
- Credited: Kenshin
- Disclosed: 2023-06-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/450
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-04
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** StandardFunding.sol _updateTreasury / claimDelegateReward (Ajna grants)
**Root cause:** _updateTreasury re-adds (fundsAvailable - totalTokensRequested) to treasury, but fundsAvailable is 100% of GBC while totalTokensRequested caps at 90%; the 10% delegate-reward portion already paid via claimDelegateReward is never subtracted, so treasury accounting exceeds actual balance.
**Steps:**
1. Deploy GrantFund with 500M AJNA treasury; call `startNewDistributionPeriod()` -> GBC = 15M (3%), treasury = 485M.
2. Create proposals requesting 90% of GBC (13.5M total); run screeningVote, fundingVote, updateSlate, executeStandard so 13.5M is paid out.
3. Have 6 voters call `claimDelegateReward(distributionId)` paying out 1.5M (10% of GBC).
4. Refund only the 90% received back via `fundTreasury`, then call `startNewDistributionPeriod()`; `_updateTreasury` adds `fundsAvailable - totalTokensRequested` = 10% back, so treasury reads 485M while actual token balance is 498.5M.
5. Observe new GBC computed from inflated treasury, over-reserving funds that do not exist.
**How found:** Code review of `_updateTreasury` noticed `fundsAvailable` represents 100% of GBC while `totalTokensRequested` is bounded to 90%, and `claimDelegateReward` payouts are never deducted, implying the 10% reserve is re-added despite being spent.
**Exploitation:** Any distribution period where winning proposals consume the full 90% and delegates claim their 10% causes the treasury counter to be inflated by 10% of GBC each period; over successive periods the protocol grants more than its real balance, eventually failing to fund proposals or rewards.
**Escalation:** Repeated periods compound the accounting drift, progressively over-committing treasury relative to actual token holdings.
**Insight:** When a contract reserves a budget split into grant + incentive buckets, check that every payout path (including separate claim functions) is subtracted before re-adding unused reserve; the invariant treasury_counter == token.balanceOf must hold after each period.