# Malicious Users Can Deny Notional Treasury From Receiving Fee

Anyone can call Aura's getReward on behalf of the vault, front-running the keeper so the pre/post balance delta is zero and the Notional Treasury fee is never paid.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-09-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/82
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window vuln:accounting-error vuln:business-logic vuln:fee-bypass vuln:reward-distribution

**Target:** AuraStakingMixin.claimRewardTokens / Aura BaseRewardPool4626
**Root cause:** claimRewardTokens measures earned rewards via pre/post balance delta of the vault, but Aura's getReward is permissionless and can be called by anyone for any account, so a front-runner drains the pending rewards before the keeper's call, making the delta zero.
**Steps:**
1. Vault accrues BAL/AURA rewards in Aura BaseRewardPool over time.
2. Attacker observes keeper tx calling `vault.claimRewardTokens()` in mempool.
3. Attacker front-runs with `auraPool.getReward(vault.address, true)` from any account, transferring rewards directly to the vault.
4. Keeper's `claimRewardTokens` calls `AURA_REWARD_POOL.getReward(address(this), true)` which returns nothing; pre/post balance delta is 0.
5. Fee branch `claimedBalances[i] > 0` is skipped, so `FEE_RECEIVER` (Notional Treasury) receives 0.
**How found:** Code review of claimRewardTokens noticed fee is computed from pre/post balance delta; reading Aura's BaseRewardPool4626 getReward revealed it is callable by anyone for any account, making the delta manipulable by front-running.
**Exploitation:** Front-run the keeper's claimRewardTokens with a permissionless Aura getReward(vault, true) call; rewards land in the vault but the fee accounting sees zero delta, so the treasury fee is silently skipped. Repeatable each harvest cycle.
**Insight:** When a contract measures income via balance deltas around an external claim call, check whether that claim function is permissionless for arbitrary accounts — an attacker can pre-drain it so the delta reads zero and downstream fee/split logic is bypassed.