# Most of the FTC rewards can be taken by single entity

FTCHook mints FTC rewards on position increase but does nothing on decrease, letting a trader open and instantly close a position to farm epoch rewards for only trading fees.

- Payout: Contest reward
- Severity: medium
- Program: Flex Perpetuals
- Credited: farman1094
- Disclosed: 2025-01-27
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-flex-perpetuals#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-flex-perpetuals%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** FTCHook.onDecreasePosition / TLC staking reward hook
**Root cause:** onDecreasePosition is a no-op, so FTC minted on position increase is never clawed back when the position is closed; reward accrual is based on position size, not holding duration or profit.
**Steps:**
1. Deposit 100,000 USDC collateral for BOB.
2. Build and sign a TradeOrder opening +100,000 sizeDelta on wethMarketIndex via intentHandler.execute.
3. In the same block, build and sign a reduceOnly TradeOrder with sizeDelta -100,000 and execute it.
4. Withdraw collateral; FTC remains staked under BOB for the epoch via tlcStaking.getUserTokenAmount.
5. Repeat across epochs to dominate reward share, paying only ~$201 in trading+execution fees per 250,000 FTC.
**How found:** Code reading of FTCHook: noticed onDecreasePosition is an empty function while onIncreasePosition mints and stakes FTC, implying asymmetric reward accrual exploitable by instant open/close.
**Exploitation:** Attacker opens a large position to mint FTC into TLC staking for the current epoch, then immediately closes it in the same block (zero net PnL), keeping the minted FTC stake. Because onDecreasePosition does nothing, the stake is never reduced. Attacker repeats to capture most of the epoch's USDbC reward pool, which is meant to be shared among genuine traders.
**Escalation:** Scale with flash loans or larger position sizes to capture an arbitrarily large share of epoch rewards; target epochs with the highest reward pool.
**Insight:** When a reward hook mints/stakes on one lifecycle event (increase) but is a no-op on the inverse event (decrease), check whether the reward can be captured without holding exposure; also verify that any 'min profit duration' guard applies to zero/negative-PnL trades, not just profitable ones.