# Incentive accumulation can be sandwiched with additional shares to gain advantage over long-term depositors

Acala incentives snapshot fixed rewards per accumulation period; depositing shares just before accumulation and withdrawing after lets an attacker crowd out long-term depositors.

- Payout: Contest reward
- Severity: medium
- Program: Acala Network
- Credited: 0xTheC0der
- Disclosed: 2024-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-acala-findings/issues/88
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-acala%3AM-02
- Tags: domain:oss domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:race-window vuln:business-logic vuln:reward-distribution

**Target:** Substrate incentives pallet (accumulate_incentives / add_share / claim_rewards)
**Root cause:** Incentive rewards are a fixed amount split among all shares present at the periodic accumulate_incentives call, with no time-weighting of deposits and no unbonding period on share withdrawal.
**Steps:**
1. Observe accumulate_incentives runs every T::AccumulatePeriod blocks via on_initialize, splitting a fixed reward across total_shares.
2. Acquire large DEX shares (borrow or mint underlying) before the accumulation block.
3. Deposit shares via add_share so total_shares is inflated at accumulation.
4. After accumulation, claim_rewards and withdraw shares immediately (no unbonding).
5. Repeat each period; PoC diff shows same total reward accrues with 2x shares, halving honest users' share.
**How found:** Code reading of the incentives pallet: noticed rewards are fixed per period and split by current total_shares, that eligibility only requires shares present at the on_initialize accumulation, and that withdrawal has no unbonding period (contrasted with the earnings module which enforces one).
**Exploitation:** Attacker borrows/mints large DEX share position, deposits just before the accumulation block, waits one block, claims the inflated share of fixed rewards, then withdraws and repeats each period, capturing most of the reward pool from long-term depositors.
**Insight:** When a reward distributor snapshots balances at a periodic hook, check whether deposit/withdraw is time-weighted or has an unbonding lock; if not, the snapshot can be sandwiched. Compare sibling modules (here earnings) for the missing lock as a tell.