# Removal of pool from reward zone does not allow gulping emissions which were already distributed in the past

Removing a pool from Blend's reward zone sets its emission index to i128::MAX, so later gulp_emissions overflows and reverts, permanently locking already-distributed emissions.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: YouCrossTheLineAlfie
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-16
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:dos

**Target:** Soroban backstop emissions manager (Rust)
**Root cause:** remove_pool sets the removed pool's rz emission index to i128::MAX to stop future emissions, but update_rz_emis_data computes (gulp_index - emission_data.index) * SCALAR_14, which underflows/overflows i128 when gulping.
**Steps:**
1. Set up backstop with a pool in reward zone having non_queued_tokens > 0 and rz_emis_data.index = 1234*SCALAR_7, rz_emission_index = 5678*SCALAR_7.
2. Call `remove_from_reward_zone(e, pool)` after pool falls below threshold; index becomes i128::MAX.
3. Call `gulp_emissions(e, pool)`; `update_rz_emis_data` computes `fixed_mul_floor(gulp_index - i128::MAX, SCALAR_14)` and reverts on overflow.
4. Observe distributed emissions for that pool are unrecoverable.
**How found:** Code review of remove_pool's i128::MAX index sentinel versus the subtraction in update_rz_emis_data; confirmed with a unit test asserting the gulp reverts.
**Insight:** When a sentinel max value is used to freeze an index, check every downstream arithmetic path that subtracts that index — the freeze silently converts into an overflow DoS on legitimate accrual.