# A malicious user can front-run Gauges's call addBribeFlywheel to steal bribe rewards

Uninitialized endCycle in FlywheelAcummulatedRewards lets an attacker front-run addBribeFlywheel, stake gauge tokens, and drain the full bribe reward pool.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: said
- Disclosed: 2023-09-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/206
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-29
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** FlywheelAcummulatedRewards / Gauge addBribeFlywheel (Solidity)
**Root cause:** endCycle is never initialized in the FlywheelAcummulatedRewards constructor, so accrueBribes distributes the entire reward balance immediately on first accrual instead of over a cycle.
**Steps:**
1. Deploy gauge and flywheel; admin deposits 100 ETH to depot rewards.
2. Attacker front-runs owner's `gauge.addBribeFlywheel(flywheel)` by calling `gaugeToken.incrementGauge(gauge, 100e18)` with minted/flash-loaned hermes.
3. Owner's `addBribeFlywheel` executes, attaching the bribe flywheel.
4. Attacker calls `gauge.accrueBribes(alice)` then `flywheel.claimRewards(alice)`, receiving the full 100e18 reward balance.
5. Attacker calls `gaugeToken.decrementGauge(gauge, 100e18)` and repeats on the next new gauge.
**How found:** Code reading of FlywheelAcummulatedRewards constructor revealed endCycle is declared but never set, so the first accrueBribes call distributes the whole balance; attacker timing of addBribeFlywheel makes the drain trivial.
**Exploitation:** Attacker observes pending addBribeFlywheel tx, stakes a large gauge balance first (own tokens or flash loan), lets the flywheel attach, then triggers accrueBribes/claimRewards to capture the entire pre-funded bribe pool, then unstakes and moves to the next gauge.
**Insight:** When a rewards accumulator uses a cycle-end timestamp, check that the constructor actually initializes it; an unset endCycle makes the first accrual dump the entire funded balance to whoever stakes first, so front-running the flywheel-attach tx is a reliable drain.