# Total reward shares for token can reach zero after unlocking, causing GTELaunchpadV2Pair to be bricked

Distributor reverts with NoSharesToIncentivize when totalShares hits zero post-unlock, bricking GTELaunchpadV2Pair swaps and liquidity.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: hgrano
- Disclosed: 2026-02-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-07
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** GTELaunchpadV2Pair / Distributor reward accounting
**Root cause:** Rewards program only ends when totalFeeShare==0 AND !unlocked; after unlock, totalShares can drop to zero while rewards remain active, so Distributor::addRewards reverts on the zero-shares check.
**Steps:**
1. Deploy/observe launch token; stakers hold shares in Distributor.
2. Token unlocks (unlocked=true).
3. All original stakers transfer out, driving rs.totalShares to 0.
4. Accumulate non-zero launchpad fees and let time elapse.
5. Trigger any pair function calling _update (swap/add/remove liquidity).
6. Pair calls Distributor::addRewards, hits `if (rs.totalShares == 0) revert NoSharesToIncentivize();`, reverts, bricking the pair.
**How found:** Code reading of the rewards-end condition on LaunchToken.sol:147 (`totalFeeShare == 0 && !unlocked`) versus the zero-shares revert in Distributor.sol:119; noticed the guard only fires pre-unlock, leaving a post-unlock zero-shares state that reverts addRewards.
**Exploitation:** Any user can trigger _update via a swap or liquidity action once shares are zero and fees accrued; the revert permanently blocks pair operations (DoS), no value extraction.
**Insight:** When a reward/accounting module reverts on a zero-denominator or zero-shares state, check whether the lifecycle guard that ends the program covers all states (pre/post unlock); a mismatched boolean condition leaves a reachable bricking state.