# Permanent Pool Lockout via Arithmetic Overflow in Reward Distribution Logic

Unbounded reward rate/duration in Aquarius stableswap causes u128 overflow in reward-per-share math, bricking claim/deposit/withdraw and locking LP funds.

- Payout: Contest reward
- Severity: medium
- Program: Aquarius
- Credited: zzebra83
- Disclosed: 2025-09-01
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_aquarius_aug2025.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** liquidity_pool_stableswap Soroban contract reward distribution
**Root cause:** REWARD_PRECISION * accumulated overflows u128 in update_reward_inv, and result * user_share overflows in calculate_user_reward, since tps and duration are unconstrained.
**Steps:**
1. Deploy stableswap pool with reward token at 7+ decimals
2. Deposit LP tokens
3. Admin calls `set_rewards_config(admin, end_ts, tps)` with large tps (e.g. `1000_00000000`) and 30-day duration
4. Mint `tps*duration` reward tokens to pool
5. Jump ledger to end of reward period
6. Call `claim(user)` -> panics with 'attempt to multiply with overflow'
7. All subsequent claim/deposit/withdraw/set_rewards_config calls revert, including admin's attempt to set tps=0
**How found:** Code review of reward math in rewards/src/manager.rs; noticed unconstrained tps/duration and u128 multiplication before division in both per-share accumulation and user payout.
**Exploitation:** Admin or reward config with large tps/duration causes accumulator overflow; once triggered every reward-touching function panics, permanently locking LP funds with no recovery path since set_rewards_config also reverts.
**Insight:** In fixed-point reward accumulators, multiplication before division (PRECISION*accumulated/supply) is a classic overflow trap; check whether config params feeding the accumulator are bounded, and whether the admin can still reset state after overflow (here they cannot, making DoS permanent).