# User can steal other users’ emissions due to vulnerable claim implementation

Blend backstop execute_claim deposits claimed LP shares to a `to` address without syncing its emission index, letting an attacker claim another user's emissions.

- Payout: Contest reward
- Severity: high
- Program: Blend
- Credited: oakcobalt
- Disclosed: 2025-08-13
- Write-up quality: 8/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Soroban backstop contract emissions claim
**Root cause:** execute_claim updates `to`'s user_balance shares without calling update_emissions first, so a fresh `to` address with zero prior emission data claims historical emissions from index 0.
**Steps:**
1. Set up backstop with two users (samwise, frodo) each holding 9_0000000 shares and identical user emission data.
2. Call `execute_claim(&e, &samwise, &[pool_1_id], &samwiseC)` where samwiseC is attacker-controlled with no emission data — returns 76_3155136.
3. Immediately call `execute_claim(&e, &samwiseC, &[pool_1_id], &samwiseC)` — returns 37_8984270 despite samwiseC having 0 prior shares.
4. Call `execute_claim(&e, &frodo, ...)` — panics with balanceError because emissions were drained.
**How found:** Code review of execute_claim noticed the deposit path updates user_balance for `to` but omits the update_emissions call that the normal deposit flow performs atomically before balance changes, flagging a state-sync conflict.
**Exploitation:** Attacker claims emissions into a fresh controlled address, then immediately re-claims from that address; the uninitialized emission index causes the new address to accrue emissions from index 0, draining the pool so the victim's claim reverts. Repeatable across many controlled addresses.
**Escalation:** Repeat with multiple attacker-controlled `to` addresses to drain the entire emission pool.
**Insight:** In reward-accrual contracts, any path that mutates a user's share balance must first sync their reward index; audit every balance-write site (transfers, claims-to-third-party, migrations) for a missing update_emissions/updateReward call, especially when `from != to`.