# Accumulated rewards in FSTO can be stolen by the agent’s owner

Agent owner claims FSTO delegation rewards in new WNAT after address upgrade, bypassing totalCollateral accounting, then sweeps rewards from CPT holders.

- Payout: Contest reward
- Severity: medium
- Program: Flare
- Credited: pashap9990
- Disclosed: 2025-11-27
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-08-flare-fasset#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** CollateralPool.sol claimDelegationRewards / upgradeWNatContract
**Root cause:** claimDelegationRewards measures balance delta of the current wNat address; after the WNAT contract is upgraded, rewards arrive in the new token but totalCollateral accounting and pool collateral still reference the old token, so claimed rewards are not credited to CPT holders.
**Steps:**
1. Users deposit WNAT into agent collateral pool via `enter`.
2. Agent owner delegates voting power to signal providers; FTSO rewards accrue.
3. Asset updater changes WNAT address in FTSO; anyone calls `AssetManagerController::updateContracts` (no access control).
4. Agent owner calls `CollateralPool::claimDelegationRewards(rewardManager, epoch, proofs)` — new WNAT transferred to pool but `totalCollateral` unchanged.
5. Agent owner calls `CollateralPool::upgradeWNatContract` to swap old WNAT for new.
6. Agent owner sweeps collected new WNAT as reward after announcing destruction.
**How found:** Noticed claimDelegationRewards uses `wNat.balanceOf` delta while totalCollateral and pool collateral reference a fixed token address; hypothesized that a WNAT address change between claim and accounting would orphan rewards, then built a Foundry/Hardhat PoC with a WNatMock and RewardManagerMock to confirm the share discrepancy.
**Exploitation:** Agent owner waits for WNAT address upgrade, claims delegation rewards in the new token (not counted in totalCollateral), swaps old WNAT via upgradeWNatContract, then withdraws the uncounted new WNAT, leaving CPT holders with reduced share (PoC shows 500 NAT loss per user).
**Insight:** When a contract measures rewards via balance delta of a mutable token address, check whether the token address can be swapped (upgrade, oracle update) between claim and accounting — the delta then lands in an untracked token and becomes sweepable.