# Wrong reward distribution formula, YT holders can get more rewards for themselves by just collecting accrued YBT yield

Napier's YT reward index divides rewards by YT supply only, so a YT holder who claims accrued YBT yield early captures extra rewards at other holders' expense.

- Payout: Contest reward
- Severity: high
- Program: Napier
- Credited: Catowice
- Disclosed: 2025-03-11
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_napier_february2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Anapier_february2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** PrincipalToken / RewardMathLib reward distribution
**Root cause:** Rewards are accrued as ytBalance * (index - prevIndex) with index scaled by totalAccrued/ytSupply, ignoring that claimed YBT yield itself earns rewards; claiming reduces PT's YBT balance and reward speed while the claimer keeps full YT share.
**Steps:**
1. Deploy PT with 100 YBT in pool, exchange rate 1; Alice and Bob each hold 50 YT (50% each).
2. Accrue rewards at 50 tokens per +1 exchange rate; raise exchange rate to 2 (50 rewards, 50 YBT yield).
3. Alice calls `principalToken.collect(alice, alice)` claiming 25 YBT and 25 rewards; PT now holds 75 YBT.
4. Raise exchange rate to 3; remaining 75 YBT earns 37.5 rewards split 50/50.
5. Alice ends with 56.25 rewards (43.75 from YT + 12.5 from her claimed YBT) vs Bob's 43.75.
**How found:** Code review of RewardMathLib.updateIndex and accrueUserReward noticed the index divides by ytSupply only and never accounts for claimed YBT yield still earning rewards; confirmed with two textual and coded forge PoC scenarios.
**Exploitation:** Any YT holder claims accrued YBT yield early; the claimed YBT continues earning external rewards for them while the PT's reduced YBT balance lowers reward speed for everyone else, shifting rewards to the claimer.
**Insight:** In yield-token/reward-index designs, check whether the index denominator accounts for balances that left the pool but still earn yield (claimed principal/yield tokens); compare claim-early vs claim-late scenarios to expose reward dilution.