# Reward sandwiching in VotiumStrategy

VotiumStrategy lets users deposit just before reward claims and exit next epoch using others' expirable tokens, dodging the 16-week vlCVX lock.

- Payout: Contest reward
- Severity: medium
- Program: Asymmetry Finance
- Credited: adriro
- Disclosed: 2024-02-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/45
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** VotiumStrategy vault reward/withdrawal queue
**Root cause:** Rewards are deposited as an immediate value increase while withdrawals can be satisfied by expirable tokens from prior deposits, so a depositor can exit as early as the next epoch instead of committing 16 weeks.
**Steps:**
1. Attacker deposits into VotiumStrategy just before rewards are claimed.
2. Rewarder claims and deposits rewards back, raising share value.
3. Attacker requests withdrawal; enough expirable tokens exist so it queues for next epoch.
4. Attacker exits next epoch with reward share, minimal commitment.
**How found:** Recognized the pattern as a common reward-compounding vault sandwich: rewards deposited as instant value increase plus a withdrawal queue backed by unrelated expirable tokens enables short-term entry/exit.
**Exploitation:** Precondition: enough expirable tokens from prior deposits to cover the position. Attacker times deposit before reward claim, then queues withdrawal immediately after, exiting next epoch with rewards while avoiding the 16-week vlCVX lock.
**Insight:** In lock-based yield strategies, check whether the withdrawal queue can be satisfied by tokens from other users' deposits — that decouples exit timing from the lock and enables reward sandwiching.