# SiloVault will incorrectly accrue rewards during user transfer/transferFrom actions due to unsynced totalSupply()

SiloVault's _update hook claims rewards on transfer/transferFrom without first calling _accrueFee(), so fee shares minted from accrued interest are missed, causing incorrect reward accrual.

- Payout: Contest reward
- Severity: medium
- Program: Silo Finance
- Credited: oakcobalt
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-03-silo-finance#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-03-silo-finance%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** SiloVault ERC4626 vault share token transfer hook
**Root cause:** The _update() hook calls _claimRewards() before _accrueFee(), so totalSupply() used for reward accrual excludes newly minted fee shares during transfer/transferFrom, unlike claimRewards() which accrues fees first.
**Steps:**
1. Observe claimRewards() calls _updateLastTotalAssets(_accrueFee()) before _claimRewards(), minting fee shares to feeRecipient and syncing totalSupply().
2. Observe deposit/withdraw paths also call _accrueFee() before state changes.
3. Call transfer()/transferFrom() on SiloVault shares; _update() invokes _claimRewards() directly without _accrueFee().
4. Reward accrual uses stale totalSupply() (missing pending fee shares), producing incorrect/inconsistent reward distribution.
**How found:** Code-reading comparison of the claimRewards() flow (which accrues fees before claiming) against the _update() hook used by transfer/transferFrom, spotting the missing _accrueFee() call before _claimRewards().
**Exploitation:** Any share holder triggers transfer/transferFrom; the hook claims rewards against an unsynced totalSupply, misallocating accrued fee shares. No capital or special precondition beyond holding vault shares.
**Insight:** When a vault mints fee shares to sync totalSupply, audit every entry point that touches share balances (transfer hooks, mint/burn overrides) for a missing accrue step; ERC4626 _update overrides are a common place where the accrual ordering diverges from the canonical claim path.