# Funding cycles that use JBXBuybackDelegate as a redeem data source (or any derived class) will slash all redeemable tokens

JBXBuybackDelegate's empty redeemParams returns reclaimAmount 0, so funding cycles using it as redeem data source burn tokens for zero payout.

- Payout: Audit contest
- Severity: medium
- Program: Juicebox
- Found by: ABA
- Disclosed: 2023-07-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-05-juicebox#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-juicebox%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error

**Target:** JBXBuybackDelegate treasury data source contract (redeemParams)
**Root cause:** redeemParams is implemented as an empty function returning default zero values instead of passing through _data.reclaimAmount.value, _data.memo and a zero delegate, so the terminal overwrites the bonding-curve reclaim amount with 0.
**Steps:**
1. Configure a funding cycle with useDelegateForRedemption=true and data source JBXBuybackDelegate.
2. Beneficiary redeems project tokens via the terminal.
3. Terminal calls JBXBuybackDelegate.redeemParams(_data), which returns empty defaults (reclaimAmount=0).
4. Redemption proceeds with reclaimAmount 0, burning tokens for zero tokens returned.
**How found:** Code review of the data source interface implementation against Juicebox docs, noting docs require passing through input variables rather than zero defaults when a function is intentionally unused.
**Escalation:** Impact amplified because redeemParams lacks the virtual keyword, so derived classes cannot override the faulty implementation.
**Insight:** When auditing treasury/extension data-source contracts, compare each stub interface function against protocol docs: an intentionally unused hook must still pass through input values, since returning zero defaults silently overrides protocol bonding-curve math.