# Attacker can pass duplicated reward token addresses to steal the reward of contract twTAP.sol

twTAP._claimRewardsOn indexes claimable amounts by loop position, so passing a duplicated reward token address claims the same reward multiple times.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: KIntern\_NA
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1094
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-27
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** twTAP.sol governance reward-claiming contract
**Root cause:** _claimRewardsOn uses the loop index i to read amounts[i] from claimable() but resolves the token via rewardTokenIndex[_rewardTokens[i]] without deduplicating the caller-supplied _rewardTokens array, so a repeated token address re-claims the same amount.
**Steps:**
1. Storage rewardTokens[] = [usdc, usdt]; claimable(tokenId) returns amounts[] per storage index.
2. Call claimAndSendRewards/_claimRewardsOn with _rewardTokens[] = [usdt, usdt].
3. Iteration 0: claimableIndex = rewardTokenIndex[usdt] = 1, amount = amounts[0], transfers usdt.
4. Iteration 1: same token, amount = amounts[1], transfers usdt again — double payout of the same reward.
**How found:** Code review of _claimRewardsOn: noticed amounts[] is indexed by loop position i while the token is resolved from user input, and claimable() is not recomputed per iteration, implying duplicate entries reuse stale amounts.
**Exploitation:** Attacker with a twTAP position calls the cross-chain claim path (BaseTOFT message) supplying a _rewardTokens array padded with duplicates of a high-value reward token, receiving that token's claimable amount multiple times and draining reward pool funds.
**Insight:** When a claim function pairs a user-supplied token list with a positionally-indexed amounts array, test duplicate/reordered entries — index-vs-key mismatch lets one reward be claimed repeatedly.