# Some rewards from POL will not be send to team wallet nor burned

Salty.IO upkeep withdraws POL, triggering StakingRewards share decrease that sends SALT rewards to DAO without team share or burn.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: 0xRobocop
- Disclosed: 2024-04-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/333
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-20
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Upkeep/Liquidizer/StakingRewards contracts
**Root cause:** Withdrawing POL decreases DAO's staking shares, which sends proportional rewards to the DAO, but upkeep does not account for these rewards to send team share or burn.
**Steps:**
1. Call `upkeep()`; it calls `liquidizer.performUpkeep()`.
2. If USDS to burn > liquidizer balance, `Liquidizer` withdraws POL from usds/dai and usds/salt pools.
3. Withdrawal decreases DAO's shares in `StakingRewards`, sending SALT rewards to DAO.
4. These rewards bypass team wallet share and burn.
**How found:** Code reading of upkeep flow: noticed Liquidizer withdraws POL, which decreases DAO shares and sends rewards, but upkeep only handles rewards from emitter.
**Exploitation:** Any upkeep call where liquidizer lacks USDS triggers POL withdrawal; rewards accrue to DAO instead of being distributed/burned.
**Insight:** When a contract withdraws liquidity, check whether share-decrease side effects mint/transfer rewards that bypass the protocol's normal distribution/burn accounting.