# An attacker can consistently steal the majority of the daily mint rewards by opening and closing a trove atomically

Atomic open-and-close of a trove in one tx still credits the full daily mint reward share, letting flash-loan-funded attackers steal most of the day's BIMA emissions.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: Spearmint
- Disclosed: 2025-02-05
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.12
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.12
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** TroveManager daily mint reward accounting (BorrowerOperations openTrove/closeTrove)
**Root cause:** _updateIntegrals credits pending rewards based on point-in-time balance at open, and closing the trove in the same block does not remove or forfeit the already-accrued reward share for that day's mints.
**Steps:**
1. Register emission receiver and vote MAX_POINTS for the trove manager mint reward id.
2. Warp one week so rewards are active; refresh oracle.
3. Open a large trove via `_openTrove(user2, 10e18, 100_000e18)` and close it in the same transaction with `borrowerOps.closeTrove(...)`.
4. Warp to next day and call `claimableReward(user2)`; observe ~7.59e25 vs honest user's ~7.59e23.
**How found:** Code review of _updateIntegrals/_updateIntegralForAccount reward accounting, noticing no handling for same-block trove closure and that point-in-time balance is credited without holding duration.
**Exploitation:** Attacker flash-loans collateral (Morpho/Balancer, 0 fee), opens a huge trove minting USBD to dominate that day's total mints, closes the trove atomically in the same tx, then claims the majority of daily mint rewards next day; profitable when rewards exceed borrowing fee, and fee-free during Recovery Mode.
**Escalation:** Scaling position size via flash loans maximizes share of daily emissions; Recovery Mode removes borrowing fees making it near-costless beyond gas.
**Insight:** In emissions/reward accounting, check whether accrual uses point-in-time balance snapshots that survive a same-block open/close; any reward credited at open without a minimum holding period is flash-loan farmable.