# User doesn't have to deposit for a week into the market to get their weekly reward from the LendingLedger

LendingLedger rounds deposit timestamps down to week start, so depositing at 23:59 and withdrawing at 00:00 earns a full week of CANTO rewards.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Credited: SpicyMeatball
- Disclosed: 2023-10-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-verwa-findings/issues/416
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** LendingLedger reward accounting contract (veRWA)
**Root cause:** Reward epochs are computed by rounding the sync timestamp down to the start of the week, so any balance present at any instant within a week is treated as held for the entire week.
**Steps:**
1. Whitelist market and set rewards via `ledger.setRewards(0, WEEK*10, amountPerEpoch)`
2. Warp to `(WEEK*5)-1` (23:59 of week 4) and call `ledger.sync_ledger(lender, 1.1 ether)` from the lending market
3. Warp +1 second to week 5 and call `ledger.sync_ledger(lender, -1.1 ether)` to withdraw
4. Call `ledger.claim(lendingMarket, 0, type(uint256).max)`; user receives full epoch reward (~1 ether) despite holding for 1 second
**How found:** Reading the reward accounting logic, noticed epoch/week rounding truncates timestamps to week start, making sub-second deposits indistinguishable from week-long deposits; confirmed with a Foundry PoC.
**Exploitation:** Deposit just before a week boundary and withdraw immediately after; the ledger credits the full week's epoch reward to the depositor, diluting rewards of honest long-term depositors and defeating the liquidity-attraction purpose of veRWA.
**Insight:** In time-weighted reward ledgers, check whether balance snapshots are bucketed by truncating timestamps to epoch boundaries; any bucket-based accounting lets a flash deposit at the boundary capture a full bucket.