# Missing update_rz_emis_data calls in draw and donate functions lead to incorrect emissions distribution

Blend backstop's execute_draw and execute_donate modify non_queued_tokens without calling update_rz_emis_data, skewing reward-zone emissions index and misallocating emissions between pools.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: 0x007
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-05
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:rust tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Soroban/Rust backstop emissions manager (fund_management.rs, manager.rs)
**Root cause:** execute_draw and execute_donate change pool non_queued_tokens without first calling update_rz_emis_data, so the reward-zone emissions index is computed against post-change balances instead of the balances that existed during the distribution period.
**Steps:**
1. Set up reward zone with multiple pools having distinct token balances and emission data.
2. Call `distribute` to snapshot emissions state.
3. Call `execute_donate(&e, &user, &pool_1, 300_000_0000000)` to increase pool_1 tokens without updating rz emis data.
4. Call `gulp_emissions` on each pool.
5. Observe pool_1 eps roughly doubles (0_21016534391534 -> 0_42016534391534) and allowance doubles, confirming inflated emissions for the donated pool.
**How found:** Code review of functions mutating non_queued_tokens; noticed deposits/withdrawals call update_rz_emis_data but execute_draw and execute_donate in fund_management.rs do not, then built a modified test_gulp_emissions PoC to quantify the skew.
**Exploitation:** Donate tokens to a pool (triggerable via auction) so its non_queued_tokens rises before the next distribute; the emissions index then uses the inflated balance, granting that pool more than its fair share of emissions. Draw has the inverse effect, under-rewarding pools.
**Insight:** When auditing emissions/reward accounting, enumerate every function that mutates the balance used as the emission denominator and check each one snapshots the index first; asymmetric omissions (some paths update, others don't) are the tell.