# Sending more TAP tokens to the TapToken.sol contract does not actually increase the total amount to be distributed

Extra TAP sent to TapToken is burned and re-emitted but still deducted from dso_supply, accelerating emission decay and risking underflow that blocks weekly rollover.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca DAO
- Credited: deadrxsezzz
- Disclosed: 2024-05-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/84
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-23
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** TapToken.sol emission accounting (emitForWeek/extractTAP)
**Root cause:** emitForWeek burns contract-held TAP and adds it to emission, but mintedInWeek still counts it, so dso_supply is decremented for tokens that were not part of the DSO supply.
**Steps:**
1. Send TAP directly to the TapToken contract address (boosted TAP).
2. Call `emitForWeek()`: `boostedTAP = balanceOf(address(this))` is burned and added to `emission`.
3. Observe `dso_supply -= mintedInWeek[week-1]` still subtracts the boosted amount once extracted via `extractTAP()`.
4. Repeat to accelerate decay of weekly emissions; with low emissions, `dso_supply` underflows and reverts, blocking week rollover in TapToken and TapiocaOptionBroker.
**How found:** Code reading of emitForWeek: noticed the boosted-TAP branch adds external tokens to emission while the dso_supply decrement in the same function does not distinguish DSO vs externally-sent TAP.
**Escalation:** Repeated boosting can drive dso_supply to underflow, bricking weekly rollover (DoS) though no funds are locked.
**Insight:** When a contract treats its own token balance as 'extra' supply, check whether the same tokens are also subtracted from the tracked supply counter—double-counting external deposits corrupts emission schedules and can underflow.