# Users will lose rewards when buying new tokens if they already own some tokens

Market.buy updates buyer's rewardsLastClaimedValue after splitting fees, so existing holders forfeit their share of the buy fee.

- Payout: Contest reward
- Severity: medium
- Program: Canto
- Credited: Krace
- Disclosed: 2023-12-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-canto-findings/issues/9
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-canto%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** 1155tech Market.sol buy() reward accounting
**Root cause:** buy() calls _getRewardsSinceLastClaim before _splitFees, then sets rewardsLastClaimedValue to the post-split shareHolderRewardsPerTokenScaled, so the buyer's pre-existing shares never accrue the fee from this purchase.
**Steps:**
1. Deploy Market with bonding curve; create share id 1.
2. Alice buys 1 token via `market.buy(1,1)` (token1).
3. Alice buys another via `market.buy(1,1)`; fee split raises shareHolderRewardsPerTokenScaled.
4. Observe rewardsLastClaimedValue set to new value, so token1 earns no fee from second buy; run `forge test --match-test testBuyNoReward -vv`.
5. Patch: move `_splitFees` before `_getRewardsSinceLastClaim`; Alice then receives 66000000000000 extra.
**How found:** Code-reading of buy() ordering: noticed rewards captured before fee split but lastClaimed updated after, contradicting sponsor's stated intent that old shares should earn the fee.
**Insight:** In reward-per-token accounting, check the ordering of claim-snapshot vs. accumulator update; any update of lastClaimed to a post-split accumulator silently forfeits the caller's accrued share.