# Drain the rewards in the protocol

RewardManager credits rewards based on raw Balancer/Aura LP token balance, so anyone holding those LP tokens can claim rewards without depositing via Omnipool, draining the reward pool.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: Bauer
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.8
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.8
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Omnipool/RewardManager reward accounting (Solidity)
**Root cause:** getUserDeposit() values rewards from IBalancerPool.balanceOf(user) rather than tracking deposits made through Omnipool.deposit(), so externally acquired LP tokens count as deposits.
**Steps:**
1. Acquire Balancer/Aura pool LP tokens directly (not via Omnipool.deposit()).
2. Call `RewardManager.claimEarnings()`; `_updateUserState` calls `omnipool.getUserTotalDeposit(_account)`.
3. `getUserDeposit` returns `computeBptValution(poolId) * IBalancerPool(pool.poolAddress).balanceOf(user)`, crediting the external LP balance.
4. Repeat claims to deplete rewards, leaving genuine Omnipool depositors unable to claim.
**How found:** Code reading of the deposit/claim flow: noticed getUserDeposit() reads raw Balancer LP balance instead of protocol-tracked deposits, breaking the assumption that only Omnipool.deposit() users earn rewards.
**Exploitation:** Attacker obtains LP tokens of the underlying Balancer/Aura pool through any route, then repeatedly calls claimEarnings() to siphon reward emissions proportional to their LP balance, starving legitimate depositors.
**Insight:** When reward accounting reads a third-party token balance (BPT/LP) instead of protocol-internal deposit records, anyone can acquire that token externally and farm rewards; check every balanceOf-based valuation against the intended deposit path.