# Attacker can sweep all mint rewards when the system is in Recovery Mode

In Recovery Mode mint rewards accrue only to the last borrower of the day, letting an attacker open a Trove seconds before day end and sweep all rewards.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: santipu
- Disclosed: 2025-02-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.14
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.14
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** TroveManager.sol mint reward accounting (_updateMintVolume / accountLatestMint / totalMints)
**Root cause:** Mint volume is only updated when not in Recovery Mode (`if (!_isRecoveryMode) _updateMintVolume(...)`), so rewards for a full RM day are unallocated and credited to whoever borrows after RM ends.
**Steps:**
1. System stays in Recovery Mode all day; only seconds remain in the day.
2. Attacker opens a large Trove to push TCR above CCR, exiting Recovery Mode (no borrowing fee charged in RM).
3. Attacker increases debt on the Trove by a few wei, writing to `accountLatestMint` and `totalMints`.
4. Day ends seconds later; attacker claims the entire day's mint rewards at near-zero cost.
5. Alternative: liquidate a few Troves to exit RM instead of opening a Trove.
**How found:** Code reading of the `_isRecoveryMode` guard around `_updateMintVolume`, noticing rewards for RM days are never distributed and can be captured by the first post-RM borrower.
**Exploitation:** Attacker times the exit from Recovery Mode to the final seconds of a reward day, borrows a trivial amount to register mint volume, then collects the full day's undistributed mint rewards for negligible cost.
**Insight:** When reward accounting is gated behind a mode flag, check who receives the unallocated accrual when the flag flips — timing the mode transition at a period boundary can capture a whole period's rewards.