# checkpoint() does not correct effectiveBond downward at year boundaries where inflation decreases

Tokenomics.checkpoint() only corrects effectiveBond upward, so at inflation-decreasing year boundaries phantom bond capacity (~412k OLAS) persists and can be minted.

- Payout: Contest reward
- Severity: medium
- Program: Olas
- Credited: Alekso
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-01-olas#m-09
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-09
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Tokenomics.sol checkpoint() / effectiveBond accounting
**Root cause:** checkpoint() pre-credits effectiveBond with predicted maxBond from current inflation, but the settlement adjustment only fires when actual maxBond exceeds prediction (incentives[4] > curMaxBond); no else branch subtracts over-credit when blended inflation at a decreasing year boundary yields a lower actual maxBond.
**Steps:**
1. Note checkpoint() at epoch end does `curMaxBond += effectiveBond; effectiveBond = uint96(curMaxBond);` using current inflationPerSecond.
2. At settlement, incentives[4] is computed from actual blended inflationPerEpoch (lines 1138-1147 blend old and new rates across yearEndTime).
3. Adjustment `if (incentives[4] > curMaxBond)` only corrects upward; when incentives[4] < curMaxBond (year 2→3 or 9→10 decrease) no subtraction occurs.
4. Phantom capacity remains in effectiveBond; reserveAmountForBondProgram() (line 803) gates on it, allowing bond programs against phantom, minting real OLAS at maturity.
5. PoC shows ~346,068 OLAS phantom at Year 2→3, ~412,000 OLAS total across both transitions.
**How found:** Code reading of checkpoint() settlement logic: noticed the developer comment claiming `incentives[4] > curMaxBond` 'has to be always true' relies on epochs always settling late; hypothesized the assumption breaks when inflation decreases at year boundaries, producing a blended lower inflationPerEpoch and an uncorrected over-credit.
**Exploitation:** No attacker action needed; bug triggers automatically at the two inflation-decreasing year boundaries. Depository creates bond programs against phantom effectiveBond capacity, and Treasury mints actual OLAS to bondholders at maturity, exceeding intended bond allocation.
**Insight:** When accounting code pre-credits a prediction and reconciles later, check both directions of the delta; developer comments asserting an inequality 'must always hold' are prime spots to find the unhandled reverse case, especially where time-blended rates cross schedule transitions.