# Rewards/Fees claimed by LPers are not removed from the market

TermMax withdrawLiquidity credits accrued LP rewards but never decrements the reward pool, so early withdrawers inflate later LPers' payouts and can drain more than accrued.

- Payout: Contest reward
- Severity: high
- Program: TermMax
- Credited: Honour
- Disclosed: 2025-03-25
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_max_december2024.pdf#3.1.7
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** TermMax market LP withdrawal / reward accounting (Solidity)
**Root cause:** _withdrawLiquidity burns the user's lpAmt but does not reduce the distributed-rewards counter, so calculateLpReward keeps dividing by a shrinking (lpSupply - Rewardtotal) denominator while Rewarddistributed stays fixed.
**Steps:**
1. Deploy market, mint underlying to Alice/Bob/Charlie, each calls `provideLiquidity(100e8)`
2. Accrue fees via `simulateTradesToAccrueFees()` (buyFt/sellFt/buyXt/sellXt loop) so lpFt/lpXt reward balances grow
3. `vm.warp(block.timestamp + 40 days)` to unlock rewards
4. Each LPer calls `withdrawLiquidity(lpFtBal, lpXtBal)` then `redeemFtAndXtToUnderlying`
5. Observe lpFt/lpXt reward balances unchanged after all withdrawals and unequal underlying payouts despite equal deposits
**How found:** Code review of _withdrawLiquidity and calculateLpWithReward: noticed lpAmt is burned but the reward term added to lpAmt is not subtracted from Rewarddistributed, then validated with a three-LPer forge test showing reward balances unchanged post-withdrawal.
**Exploitation:** An LPer withdraws early to collect rewards computed against the full reward pool; because the claimed reward is never burned, the denominator shrinks for remaining LPers, who then receive inflated rewards. Repeated/ordered withdrawals can pay out more total lp than Rewardtotal accrued, draining value from other LPers.
**Insight:** In LP/staking reward math, check that every quantity added to a user's payout (reward, bonus, accrued interest) is symmetrically decremented from the global pool; asymmetric burn of principal-only is a classic double-count.