# In case Distributor.setDistribution use, revenue from rToken RevenueTrader and rsr token RevenueTrader should be distributed

Changing Distributor.setDistribution mid-trade leaves already-forwarded revenue stuck in RevenueTrader, and strsr stakers lose their share of revenue earned before the change.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: rvierdiiev
- Disclosed: 2023-11-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-reserve-findings/issues/34
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Distributor / RevenueTrader / BackingManager contracts
**Root cause:** Revenue is forwarded to RevenueTrader based on the distribution at forward time, but distributed based on the distribution at settle/distribute time; changing setDistribution between these steps misallocates or strands funds.
**Steps:**
1. Governance sets distribution 50/50 between strsr and furnace.
2. BackingManager.forwardRevenue sends surplus tokens to rsrTrader/rTokenTrader.
3. A Gnosis trade is started to swap token to rsr; before it settles, governance calls Distributor.setDistribution setting strsr share to 0.
4. Trade settles; distributeTokenToBuy is called manually (Gnosis path does not auto-distribute).
5. strsr share is now 0, so tokens remain stuck in rsrTrader instead of reaching strsr.
**How found:** Code reading of BackingManager.forwardRevenue, RevenueTrader.settleTrade/distributeTokenToBuy, and Distributor.setDistribution, noticing distribution is read at two different times (forward vs distribute).
**Exploitation:** Not an attacker-driven exploit; governance timing of setDistribution causes revenue to be stranded in RevenueTrader or underpaid to strsr stakers.
**Insight:** When a protocol snapshots a config (e.g. distribution shares) at one step but applies it at a later step, look for state changes in between that desync accounting; here the Gnosis trade path also skips auto-distribution, widening the window.