# Front run `distributeRewards()` can steal the newly added rewards

Front-running distributeRewards() lets an attacker deposit large capital, capture the pointsPerShare surge, and exit with most newly added rewards.

- Payout: Contest reward
- Severity: medium
- Program: Merit Circle
- Credited: WATCHPUG
- Disclosed: 2022-10-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-merit-circle-judging/issues/106
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-merit-circle%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:share-inflation

**Target:** BasePool / AbstractRewards liquidity mining staking contract
**Root cause:** distributeRewards() applies rewards as an instantaneous surge to pointsPerShare rather than streaming them over time, so whoever holds the largest share at the moment of the call captures a disproportionate portion.
**Steps:**
1. Observe pending `distributeRewards()` call adding rewards to the pool.
2. Front-run it: deposit a large amount of underlying tokens into BasePool to take a dominant share of total stake.
3. Let `distributeRewards()` execute, causing the pointsPerShare surge credited to the attacker's large balance.
4. Wait out `MIN_LOCK_DURATION` (10 minutes), then withdraw and claim the inflated rewards.
**How found:** Recognized the well-known reward-surge / share-inflation pattern by reading the distributeRewards() and pointsPerShare update logic in BasePool/AbstractRewards.
**Exploitation:** Attacker with sufficient capital (flash loans blocked by MIN_LOCK_DURATION) deposits just before the reward distribution, absorbs the pointsPerShare surge proportional to their dominant share, then exits after the lock duration, siphoning the majority of newly added rewards.
**Insight:** When rewards are credited as a lump-sum pointsPerShare jump, check whether a large deposit immediately before the distribution call captures outsized rewards; lock durations only block flash loans, not capital-rich attackers.