# RewardsManager fails to validate pool_ when updating exchange rates allowing rewards to be drained

RewardsManager.updateBucketExchangeRatesAndClaim never validates pool_, so an attacker-supplied contract fakes burn/bucket data to drain all AJNA rewards.

- Payout: Contest reward
- Severity: high
- Program: Ajna Protocol
- Credited: vakzz
- Disclosed: 2023-06-29
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/8
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** RewardsManager.updateBucketExchangeRatesAndClaim (Solidity contract)
**Root cause:** updateBucketExchangeRatesAndClaim accepts an arbitrary pool_ address and calls bucketExchangeRate/burnInfo/bucketInfo on it without verifying it is a registered Ajna pool, so all reward-calculation inputs are attacker-controlled.
**Steps:**
1. Deploy attacker contract implementing currentBurnEpoch(), bucketExchangeRate(), burnInfo(), bucketInfo() with inflated values
2. Set _currentBurnEpoch=1 and call `rewardsManager.updateBucketExchangeRatesAndClaim(address(this), [0])` to seed prevBucketExchangeRate
3. Set _currentBurnEpoch=2 and call again; burnInfo returns totalBurned_ = toSteal*20 to maximize reward
4. RewardsManager transfers ~5% of computed rewards, sized to drain full AJNA balance
**How found:** Code review of the reward-claim path: noticed pool_ is used to query exchange rate and burn info with no _isAjnaPool check, meaning a self-controlled contract could supply all inputs to the reward math.
**Exploitation:** Attacker contract returns fabricated burn/bucket data so the reward formula yields the entire RewardsManager AJNA balance; two calls (epoch 1 then 2) transfer all tokens to the attacker contract.
**Insight:** In reward/staking managers, any external address used as a data source for payout math must be validated against a registry; attacker-controlled 'pool' contracts let you fabricate burn/interest values and mint arbitrary payouts.