# Pools outside of the reward zone can keep receiving Blend tokens

Blend Backstop's update_rz_emis_data resets a removed pool's reward-zone index to the global index, letting out-of-zone pools keep accruing BLND emissions.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: Testerbot
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Soroban Backstop contract emissions manager (remove_pool/update_rz_emis_data/gulp_emissions)
**Root cause:** remove_pool sets the pool's rz index to i128::MAX to stop accrual, but update_rz_emis_data called via gulp_emissions (to_gulp=true) with zero non_queued_tokens resets the index to gulp_index, re-enabling accrual for pools no longer in the reward zone.
**Steps:**
1. Create a second pool and deposit into Backstop, add_reward to place it in the reward zone.
2. Advance time, call emitter.distribute() and backstop.distribute() so the pool accrues emissions.
3. queue_withdrawal and later withdraw, then remove_reward to remove the pool from the reward zone (index set to i128::MAX).
4. Call pool.gulp_emissions() — with non_queued_tokens()==0 the index is reset to gulp_index.
5. Deposit again and advance time; the out-of-zone pool continues accruing BLND emissions.
**How found:** Code-reading of remove_pool's set_rz_emissions(i128::MAX) invariant versus update_rz_emis_data's to_gulp branch that resets the index when non_queued_tokens()==0, then validated with a coded Soroban test.
**Exploitation:** Attacker creates a pool, gets it into the reward zone, accrues emissions, removes it, then repeatedly gulps and re-deposits to keep capturing BLND emissions outside the reward zone, diverting emissions from legit pools.
**Insight:** When a sentinel value (i128::MAX) is used to freeze an accumulator, audit every write path that can overwrite it — especially 'gulp'/sync functions that reset index to the global value on a zero-balance branch.