# Loss of Funds to user, as the user index is updated to the new index of the program, without giving any rewards

Integer truncation in Silo DistributionManager reward math yields zero rewards for small balances while still advancing the user index, permanently forfeiting accrued rewards.

- Payout: Contest reward
- Severity: medium
- Program: Silo
- Credited: ParthMandale
- Disclosed: 2025-03-19
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_silo.pdf#3.2.14
- Library page: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.14
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:precision-loss

**Target:** SiloIncentivesController / DistributionManager reward accounting
**Root cause:** _getRewards divides principalUserBalance*(reserveIndex-userIndex) by 1e18 in unchecked math; small balances truncate to 0, yet claimRewards still writes the new program index into the user's index.
**Steps:**
1. Deploy controller with 9-decimal notifier share token and 6-decimal USDC reward token
2. createIncentivesProgram with emissionPerSecond=1e6, distributionEnd=now+1000
3. Mint 99e9 share tokens to user1; total supply ~100M*1e9
4. afterTokenTransfer sets user index to 0
5. vm.warp(+1s); user1 calls `claimRewards(user1)`
6. Observe reward balance 0 but user index == program index > 0
**How found:** Code reading of _getIncentivesProgramIndex and _getRewards revealed unchecked division by TEN_POW_PRECISION; author reasoned about decimal mismatch (9-dec share token vs 6-dec reward) and constructed a numeric example showing truncation to zero.
**Exploitation:** Any user with balance below ~100e9 share tokens claims after an index update; truncation returns 0 rewards while the index write consumes their accrued entitlement, permanently losing those rewards.
**Insight:** In index-based reward accounting, check whether the index is advanced even when the computed delta truncates to zero — small-balance users silently forfeit accrual; test with realistic decimal mismatches between share and reward tokens.