# Attackers can force the rewards to be stuck in the contract with malicious x/tokenfactory denoms

Attacker funds LP farm rewards with a tokenfactory denom then MsgForceTransfer drains the contract, bricking reward claims and farm closure via insufficient-funds errors.

- Payout: Audit contest
- Severity: high
- Program: MANTRA
- Credited: peachtea
- Disclosed: 2025-03-31
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#h-09
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-09
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained vuln:business-logic vuln:dos

**Target:** CosmWasm farm-manager contract on Mantra chain (x/tokenfactory)
**Root cause:** Rewards are aggregated into a single BankMsg::Send and farm closure refunds the farm asset; a tokenfactory denom whose balance the creator can force-drain makes these sends fail with insufficient funds.
**Steps:**
1. Create an x/tokenfactory denom on the Mantra chain.
2. Mint tokens and supply them to an LP token via `FarmAction::Fill`.
3. Call `MsgForceTransfer` to move all those tokens out of the farm contract.
4. User claim of pending rewards fails: aggregated `BankMsg::Send` hits insufficient funds, blocking legitimate rewards.
5. Owner sends `FarmAction::Close`; `close_farms` refunds `farm.farm_asset.amount` to attacker, also failing with insufficient funds.
**How found:** Noticed rewards are batched into one BankMsg::Send and that Mantra chain's x/tokenfactory MsgForceTransfer lets a denom creator arbitrarily reduce the contract's balance, then reasoned the send would revert.
**Exploitation:** Attacker self-funds a farm with a controllable tokenfactory denom, then force-transfers the balance away so every aggregated reward payout and the close-farm refund revert, locking all users' accrued rewards and preventing farm closure.
**Escalation:** Single malicious farm bricks claiming for all legitimate pools sharing the aggregated send and blocks admin closure.
**Insight:** When a chain lets token creators unilaterally move balances (tokenfactory force-transfer), any contract that batches user payouts or refunds from a shared balance can be griefed into permanent revert by funding it with such a denom.