# Incorrect reward distribution when t == roundedtimestamp in feedistributor.sol contract

Off-by-one in FeeDistributor._checkpointTotalSupply loop condition misrecords epoch supply when timestamp equals rounded week, causing incorrect reward distribution.

- Payout: Contest reward
- Severity: high
- Program: Zerolend
- Credited: 0xarno
- Disclosed: 2024-09-16
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_zerolend_jan2024.pdf#3.1.5
- Library page: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.1.5
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** FeeDistributor.sol reward checkpointing (veSupply mapping)
**Root cause:** Loop break condition uses `t > roundedTimestamp` instead of `t >= roundedTimestamp`, so when the cursor equals the rounded epoch timestamp the checkpoint is skipped/misaligned, breaking the week-bound total supply invariance.
**Steps:**
1. Alice locks 100 tokens; ZeroLocker supply = 100.
2. Bob calls `checkpointTotalSupply`; FeeDistributor stores totalSupply = 100.
3. Bob locks 300 tokens; supply = 400.
4. Bob claims reward computed as `totalReward * balance / supply`; due to stale/misaligned checkpoint he receives reward=3 instead of expected 3/4 fraction.
5. Fix: change `if (t > roundedTimestamp)` to `if (t >= roundedTimestamp)` in `_checkpointTotalSupply`.
**How found:** Code review of the checkpoint loop boundary condition against the documented week-bound total supply invariance (FeeDistributor.sol#L39), spotting the strict `>` comparison at the epoch boundary.
**Exploitation:** A user times a lock/checkpoint interaction to land exactly on the rounded epoch timestamp, causing the stored veSupply to be stale relative to actual supply, inflating their share of newly minted reward tokens at others' expense.
**Insight:** In epoch/checkpoint accumulator loops, test the exact boundary where cursor equals the rounded timestamp; strict vs non-strict comparison there silently corrupts the stored supply snapshot used as reward denominator.