# Pool fraction is not truncated when allocating the tokens allowing to receive more rewards than owed

Initia's AllocateTokens used Quo() instead of QuoTruncate() for pool fraction, rounding up and over-allocating rewards to validators.

- Payout: Contest reward
- Severity: medium
- Program: Initia
- Credited: ABAIKUNANBAEV
- Disclosed: 2025-04-10
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:accounting-error vuln:precision-loss vuln:reward-distribution

**Target:** x/distribution keeper AllocateTokens pool fraction calculation
**Root cause:** poolFraction computed with LegacyDec.Quo() which rounds to nearest via chopPrecisionAndRound instead of QuoTruncate() rounding down, so the fraction can exceed the true weight ratio.
**Steps:**
1. Read x/distribution/keeper/allocation.go: `poolFraction := rewardWeight.Weight.Quo(weightsSum)`
2. Note Quo() calls chopPrecisionAndRound (rounds up when remainder >= half precision)
3. Compare vanilla Cosmos SDK which uses `QuoTruncate` for powerFraction
4. Construct weights where division remainder rounds up, yielding poolFraction slightly larger than actual ratio
5. Observe validator pool receives more than owed rewards
**How found:** Code review of the allocation logic against upstream Cosmos SDK, spotting Quo() vs QuoTruncate() divergence in rounding semantics.
**Exploitation:** A validator with a weight whose division leaves a rounding-up remainder receives a marginally inflated poolFraction, siphoning extra rewards from the distribution pool at others' expense; requires being a validator and repeated allocation cycles.
**Insight:** When porting Cosmos SDK distribution math, diff every LegacyDec operation against upstream: Quo rounds-to-nearest while QuoTruncate floors, and reward-share math must always floor to avoid systematic over-allocation.