# Incorrect calculation of the remaining updatedRewards leads to possible underflow error

RewardsManager subtracts a global per-epoch claimed total from a single-pool rewards cap, underflowing and bricking unstake/claimRewards for pools.

- Payout: Contest reward
- Severity: high
- Program: Ajna Protocol
- Credited: Haipls
- Disclosed: 2023-06-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/440
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-05
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:reward-distribution

**Target:** RewardsManager.sol reward accounting (stake/unstake/claimRewards)
**Root cause:** rewardsClaimedInEpoch/updateRewardsClaimed is a global per-epoch sum across all pools, but rewardsCap is computed per-pool from that pool's burned tokens; when the global sum exceeds a pool's cap, `rewardsCap - rewardsClaimedInEpoch` underflows and reverts.
**Steps:**
1. Note `updateRewardsClaimed[curBurnEpoch]` accumulates across all pools in `_updateBucketExchangeRates`.
2. In `_calculateNewRewards`, `rewardsCapped = Maths.wmul(REWARD_CAP, totalBurnedInPeriod)` is per-pool.
3. Have a large pool claim/update first so `rewardsClaimedInEpoch` grows large (e.g. 100e18).
4. Trigger update for a small pool whose `rewardsCapped` is smaller (e.g. 30e18).
5. Condition `rewardsClaimedInEpoch + newRewards > rewardsCapped` holds, then `newRewards = rewardsCapped - rewardsClaimedInEpoch` underflows and reverts.
6. Repeat for `_updateBucketExchangeRates` line 725; affected pools can no longer unstake/claimRewards.
**How found:** Code review of reward accounting: noticed `rewardsClaimed`/`updateRewardsClaimed` are global per-epoch mappings while `rewardsCap` is derived from a single pool's burned tokens, making the subtraction `rewardsCap - rewardsClaimedInEpoch` able to go negative.
**Exploitation:** Attacker (or naturally a huge pool) burns/claims rewards to inflate the global per-epoch claimed counter beyond a target pool's per-pool cap, causing arithmetic underflow reverts that block unstake/claimRewards and lock LP NFTs for that pool.
**Escalation:** More pools / one dominant pool increases likelihood; attacker can deliberately burn extra coins to force the condition and block positions.
**Insight:** When a cap is computed per-entity but the claimed counter is aggregated globally, the subtraction of global-minus-local can underflow; check every cap-vs-claimed subtraction for scope mismatch between numerator and denominator.