# Users will lose rewards

Omnipool.withdraw calls Aura withdrawAndUnwrap with claim=true, but RewardManager never updates its accounting, so accrued Aura rewards are lost for all users.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: Bauer
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.9
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.9
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Omnipool.withdraw / Aura pool integration
**Root cause:** _withdrawFromAura passes claim=true to auraPool.withdrawAndUnwrap, causing Aura to push reward tokens, but RewardManager._updateRewards() is not called so the reward accounting baseline is not advanced and the received rewards are not credited.
**Steps:**
1. Call Omnipool.withdraw() where underlyingBalanceBefore_ < underlyingToReceive_.
2. Observe _withdrawFromAura invoked with underlyingToWithdraw_.
3. _withdrawFromAura calls `auraPool.withdrawAndUnwrap(_bptAmountOut, true)`.
4. Aura's withdrawAndUnwrap calls getReward(msg.sender, true), transferring reward tokens to the protocol.
5. RewardManager._updateRewards() is never invoked, so the incremental reward delta is not recorded and rewards are lost.
**How found:** Code reading of the withdraw path: noticed claim=true in withdrawAndUnwrap while RewardManager only credits rewards via _updateRewards() deltas, so the claim bypasses accounting.
**Insight:** When integrating reward-bearing wrappers (Aura/Convex), check whether claim flags on withdraw paths bypass the protocol's own reward-delta accounting; the fix is claim=false and let RewardManager harvest explicitly.