# Post-exit settlement erases pending incentive rewards

K2 incentives settle rewards using post-withdrawal balance via min(balance_snapshot,user_balance), erasing accrued emissions on exit, repay, transfer, or liquidation.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: v12
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** IncentivesContract (Soroban/Rust smart contract) handle_action, claim_rewards, claim_all_rewards
**Root cause:** handle_action computes rewardable balance as min(balance_snapshot, user_balance) after token flows already reduced user_balance, settling the elapsed interval against the reduced balance; claim paths fail to advance indices (claim_rewards) or misread scaled_total_supply as u128 vs i128 (claim_all_rewards).
**Steps:**
1. User holds balance B accruing emissions over interval T.
2. User withdraws/repays/transfers/liquidated, reducing balance to B' (or 0 on full exit).
3. handle_action runs after mutation, computes min(balance_snapshot, user_balance)=B'.
4. Rewards for interval T settled against B' instead of B; full exit yields 0.
5. Attempt to pre-claim: claim_rewards only transfers stored accrued amounts without advancing indices; claim_all_rewards skips index advancement due to u128/i128 mismatch, so pending rewards cannot be crystallized first.
**How found:** Code review of handle_action ordering: noticed it is invoked after balance-reducing token flows yet uses min(balance_snapshot, user_balance), which collapses to the post-action balance; cross-checked claim paths and found claim_rewards lacks index advancement and claim_all_rewards has a u128/i128 type mismatch on scaled_total_supply.
**Exploitation:** Not an attacker-driven exploit; a logic flaw causing users to permanently lose accrued incentive emissions when reducing or closing positions, since the broken claim paths prevent reliable pre-exit settlement.
**Insight:** When rewards accrue lazily via balance snapshots, verify settlement ordering relative to balance mutations and that every claim path advances indices; a min(snapshot, current) pattern silently zeroes rewards on full exits.