# Salt Rewards - Rewards related to Arbitrage profits for pools can be lost

If step5's WETH-to-SALT swap fails, step7 still clears per-pool arbitrage profits from storage, so those rewards are misallocated to later pools instead of the pools that earned them.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: zzebra83
- Disclosed: 2024-04-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/239
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-24
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Upkeep/SaltRewards reward distribution contracts
**Root cause:** Upkeep steps are wrapped in try/catch so a failed step5 swap does not halt step7, which distributes based on contract SALT balance and then calls clearProfitsForPools(), erasing per-pool profit records without distributing them.
**Steps:**
1. Deposit WETH arbitrage profits into pools and generate arbitrage profits so profitsForWhitelistedPools() returns nonzero.
2. Manipulate pool reserves so pools.depositSwapWithdraw(weth, salt, wethBalance, 0, ...) in step5 reverts.
3. Call upkeep.step2/step3/step4 then step5 inside try/catch; observe revert and salt.balanceOf(saltRewards)==0.
4. Call step7 (optionally after step6); performUpkeep distributes based on balance, then pools.clearProfitsForPools() zeroes stored profits.
5. Verify profitsForWhitelistedPools() now all zero and liquidityRewardsEmitter pending rewards for the arbitrage pools unchanged.
**How found:** Code-reading of the multi-step upkeep flow: noticed each step is try/catch-wrapped so failures don't halt subsequent steps, then traced that step7 clears profit storage regardless of whether step5 succeeded.
**Exploitation:** Attacker forces step5 swap to fail (e.g. by draining SALT reserves in the WETH/SALT pool) so arbitrage profits are never converted; step7 then clears profit records, and in a later interval the accumulated SALT balance is distributed proportionally to whichever pools have profits then, favoring an attacker's pool.
**Escalation:** Cross-interval misallocation: profits earned by pool A in interval 1 are effectively redirected to pool B in interval 2 where attacker holds liquidity.
**Insight:** When auditing multi-step upkeep/cron flows wrapped in try/catch, check whether later steps mutate/clear state that earlier failed steps were supposed to consume—failed-step tolerance plus state clearing creates reward misallocation across intervals.