# Share holders may fail to get the expected incentive rewards

Silo incentives index uses 1e18 precision; with low-decimal reward tokens and high-decimal silo shares, frequent claims round index delta to zero, forfeiting rewards.

- Payout: Contest reward
- Severity: medium
- Program: Silo
- Credited: 0x37
- Disclosed: 2025-03-19
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_silo.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** SiloIncentivesController reward index calculation
**Root cause:** Index delta = emissionPerSecond * timeDelta * 1e18 / totalBalance; when totalBalance (scaled by token decimals + _DECIMALS_OFFSET_POW) is large relative to emission and timeDelta, integer division truncates the delta to zero.
**Steps:**
1. Deploy SiloIncentivesController with reward token of 6 decimals (USDC/USDT), emissionPerSecond=27777 (~100 USDC/day).
2. Deposit 300 DAI (18 decimals) as collateral, producing ~300e21 shares.
3. Set distributionEnd to now+30 days.
4. `vm.warp(block.timestamp + 100)` then call `claimRewards(user1)` repeatedly every 100s.
5. Observe reward token balance stays 0 because each index delta rounds down.
**How found:** Reasoned about precision mismatch: reward token decimals (6) vs silo underlying decimals (18) plus _DECIMALS_OFFSET_POW inflate totalBalance, so emissionPerSecond*timeDelta*1e18/totalBalance truncates to zero for small timeDelta.
**Exploitation:** Any user can call claimRewards() frequently to force index accrual at short timeDeltas, causing the delta to truncate to zero; all depositors lose their accrued incentive rewards.
**Insight:** When auditing reward-index accumulators, compare the precision constant against the worst-case ratio of totalBalance (including decimal offsets) to emissionPerSecond*timeDelta; low-decimal reward tokens against high-decimal share tokens are the trigger.