# Anyone can prolong the time for the rewards to get distributed

Anyone holding a few wei of credit token can call distribute(1) repeatedly, resetting endTimestamp and delaying rebase reward distribution to users.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: evmboi32
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/966
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** ERC20RebaseDistributor token contract distribute()
**Root cause:** distribute() recomputes endTimestamp = block.timestamp + DISTRIBUTION_PERIOD on every call, so a tiny new distribution restarts the interpolation window and dilutes the pending amount over a fresh 30 days.
**Steps:**
1. Deploy ERC20RebaseDistributor; mint and enterRebase for two users.
2. Call `token.distribute(40e18)` to start a 30-day distribution.
3. Each day call `token.distribute(1)` (1 wei) via `vm.warp(block.timestamp + 1 days)`.
4. Observe after 30 days only ~25.5e18 of 40e18 distributed; after 90 days ~38.1e18 still pending.
**How found:** Reading distribute() logic, noticed endTimestamp is unconditionally reset on each call rather than tracking multiple interpolations, then wrote a Foundry test warping time and calling distribute(1) to measure the shortfall.
**Exploitation:** Attacker with a few wei of credit token calls distribute(1) once per day (or per period) to keep resetting endTimestamp, stretching reward distribution indefinitely at negligible gas cost, denying timely rewards to rebasing users.
**Insight:** In rebase/streaming reward contracts, check whether a new distribution resets a single global endTimestamp; any permissionless dust-sized deposit can then grief the schedule. Compare distributed vs pendingDistributedSupply over time in a test.