# Tokens yeild can not be set to claimable.

Abracadabra's BlastYields used a wrong configure() signature returning uint256, so any nonzero token balance made the call revert, permanently blocking yield-claimable configuration.

- Payout: Contest reward
- Severity: medium
- Program: Abracadabra Money
- Credited: hassanshakeel13
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-abracadabra-money-findings/issues/236
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** BlastYields library / BlastOnboarding contract on Blast L2
**Root cause:** The interface declared configure(YieldMode) returning YieldMode, but Blast's ERC20Rebasing.configure(YieldMode) returns uint256 (caller balance). ABI decoding of the return value fails whenever the balance exceeds 2, reverting the call.
**Steps:**
1. Read Blast ERC20Rebasing.configure: `function configure(YieldMode yieldMode) external returns (uint256)` returning caller balance.
2. Compare with Abracadabra's IBlast/BlastYields declaration: `function configure(YieldMode) external returns (YieldMode)`.
3. Call enableTokenClaimable on a contract holding >2 wei of the rebasing token; the return-data decode reverts.
4. Attacker donates a tiny amount of the token to magicLP/BlastOnboarding so configure always reverts, blocking yield-claimable setup.
**How found:** Code-reading: compared the local interface signature against Blast's actual ERC20Rebasing source and noticed the return type mismatch (YieldMode vs uint256 balance).
**Exploitation:** Attacker sends a minimal amount of the rebasing token (e.g. WETH/USDB) to the BlastOnboarding or magicLP contract, ensuring its balance exceeds 2. Any subsequent call to enableTokenClaimable reverts on return-data decoding, so yield can never be set to CLAIMABLE.
**Insight:** When integrating external protocols, diff your interface declarations against the deployed source's exact return types; a mismatched return type silently reverts on ABI decode once the returned value is nonzero, and a tiny donation can weaponize it.