# Removing a pool from the reward zone leads to the loss of ungulped emissions

Removing a pool from Blend's backstop reward zone sets its index to i128::MAX without accruing pending emissions, permanently losing that pool's share of the last distribution.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: 0xAlix2
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-08
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Soroban backstop emissions manager (remove_from_reward_zone)
**Root cause:** remove_from_reward_zone calls remove_pool which sets the pool's rz emission index to i128::MAX without first calling update_rz_emis_data, so emissions accrued since the last global index update are never credited to the pool's accrued balance.
**Steps:**
1. Set up reward zone with pool_1 and pool_2, both at index SCALAR_7, accrued 0.
2. Call `distribute(&e)` so global rz emission index advances (e.g. 8_259_710_4719394) while pools' accrued stays 0.
3. Call `remove_from_reward_zone(&e, pool_2)`; remove_pool sets pool_2 index to i128::MAX and removes it from the array.
4. Observe pool_2 accrued == 0 despite index i128::MAX; its share of the last distribution is unrecoverable.
**How found:** Code review of remove_from_reward_zone/remove_pool: noticed index set to i128::MAX without an update_rz_emis_data call, unlike normal index-update paths, then wrote a unit test to confirm accrued stays zero after distribute.
**Exploitation:** Not attacker-driven; occurs naturally when a pool's backstop balance falls below threshold and it is removed between distributions, silently burning that pool's pending emissions.
**Insight:** When a contract marks an index as 'infinite' to disable future accrual, check whether the pending delta between stored and global index is settled first; the sentinel value silently discards it.