# Donations to Distributor with arbitrary quoteToken can be used to drain all quote rewards from distributor

Distributor.addRewards never validates quoteAsset, so a fake token inflates quote rewards per share, letting a staker drain all real quote tokens.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: hgrano
- Disclosed: 2026-02-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-06
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** launchpad/Distributor.sol addRewards reward accounting
**Root cause:** addRewards trusts caller-supplied quoteAsset without validating it is a legitimate registered token; a malicious contract's transferFrom can be a no-op while rs.addQuoteRewards and _increaseTotalPending still inflate quote reward accounting.
**Steps:**
1. Attacker deploys malicious token implementing transferFrom that transfers nothing (or returns true without moving funds).
2. Attacker calls `addRewards(token0=legitLaunchToken, token1=maliciousToken, amount0=0, amount1=X)` where X is large.
3. addRewards records X as quote rewards via `rs.addQuoteRewards` and `_increaseTotalPending`, but `quoteAsset.safeTransferFrom` pulls nothing.
4. Quote rewards per share are now massively over-inflated; attacker (holding non-zero staking balance) claims/drains all real quote tokens from the contract.
**How found:** Code review of addRewards: noticed quoteAsset is taken directly from caller input with no whitelist/validation, and that only amount>0 branches matter, so a fake token with a no-op transferFrom inflates accounting without contributing funds.
**Exploitation:** Attacker needs a non-zero staking balance in the pool. They register a fake quoteAsset via addRewards with a large amount1 and zero actual token transfer, inflating quote rewards per share, then withdraws/claims to drain the contract's real quote token balance.
**Escalation:** Draining all quote tokens also bricks the system: LaunchToken triggers reward distribution on transfers, which now reverts due to insufficient quote tokens, locking users' staked tokens.
**Insight:** In reward-accounting contracts, check whether the asset address passed to a deposit/addRewards function is validated against a registry; if accounting is updated before/independent of a real token transfer, a no-op malicious token inflates share price for free.