# TroveManager's RewardIntegral update logic is flawed, users may be receiving less rewards than expected

TroveManager updates global rewardIntegral using interest-accrued totalActiveDebt while per-user debt stays stale, so users claiming rewards receive less Bima than owed.

- Payout: Contest reward
- Severity: high
- Program: Bima
- Credited: pkqs90
- Disclosed: 2025-02-05
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.1.8
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.1.8
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** TroveManager.sol reward accounting (_applyPendingRewards/_updateIntegrals)
**Root cause:** _applyPendingRewards passes the pre-accrual user debt (prevDebt) to _updateIntegrals while the global supply denominator uses totalActiveDebt already inflated by accrued interest, so the per-account integral is computed against a mismatched balance.
**Steps:**
1. Setup: totalActiveDebt=100, user debt=50, rewardIntegral=0, rewardIntegralFor[user]=0.
2. Interest accrues 10%; another user triggers _applyPendingRewards, raising totalActiveDebt to 110 while user debt stays 50.
3. 100 Bima rewards pending; user claims: rewardIntegral = 100/110 = 0.909, storedPendingReward += 50*(0.909-0) = 45.45 instead of 50.
4. Repeat across accruals to compound the shortfall.
**How found:** Compared the Masterchef-style integral mechanism to Sushiswap and noticed the divergence: debt accrues interest continuously, so the global denominator (totalActiveDebt) and per-user balance (t.debt) drift out of sync between updates.
**Exploitation:** Any user claiming rewards after interest accrual and another account's _applyPendingRewards call receives proportionally reduced Bima; no attacker action needed, loss occurs passively.
**Insight:** When porting Masterchef-style reward integrals to a system where the staked balance itself accrues (interest-bearing debt), check that the per-account balance and global supply are snapshotted at the same accrual point; stale per-user balances against a freshly-accrued denominator silently underpay.