# Malicious actors can repeatedly dilute emissions to a longer timeframe

Permissionless gulp_emissions in Blend pool resets emission expiration to now+7d each call, letting anyone repeatedly dilute pending rewards over a longer timeframe.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: rscodes
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-12
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Soroban pool contract gulp_emissions / update_reserve_emission_eps
**Root cause:** gulp_emissions is callable by anyone with no minimum interval; each call recomputes expiration as now+7 days and spreads remaining tokens over that window, so frequent calls stretch emissions indefinitely.
**Steps:**
1. Observe gulp_emissions in pool contract is permissionless and only guards new_emissions >= SCALAR_7 (1 token).
2. Call gulp_emissions whenever >=1 token is pending; update_reserve_emission_eps sets expiration = now + 7 days and eps = tokens_left * SCALAR_7 / 7 days.
3. Repeat every few minutes so remaining tokens are continually re-diluted over a fresh 7-day window.
4. Current stakers receive emissions slower than intended; attacker who plans to deposit later benefits from prolonged distribution.
**How found:** Code review of gulp_emissions and update_reserve_emission_eps noting the only guard is new_emissions >= SCALAR_7 and no minimum time between calls, so expiration is reset each invocation.
**Exploitation:** Attacker with no capital repeatedly calls gulp_emissions (e.g. every 3 minutes) to reset the emission expiration and lower eps, delaying reward distribution to existing stakers until they deposit.
**Insight:** When a permissionless function recomputes a distribution window (expiration = now + duration) from remaining balance, check for a minimum-interval guard; repeated calls can perpetually re-dilute pending rewards.