# Tier winner can steal excess funds from tiered percentage bounty if any deposits are expired

Tiered percentage bounty snapshots pool balance at claim; a winner inflates pool with a 1-second deposit, claims inflated share, then refunds to drain expired funds.

- Payout: Contest reward
- Severity: high
- Program: Openq
- Credited: ast3ros
- Disclosed: 2023-01-30
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-openq-judging/issues/275
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** TieredPercentageBountyV1 / DepositManagerV1 / ClaimManagerV1 smart contracts
**Root cause:** Payout percentage is computed from a one-time balance snapshot taken at claim time; refunded deposits don't reduce the snapshot, so a short-lived deposit inflates the pool and the winner's share.
**Steps:**
1. User A funds bounty with 10,000 USDC; deposit expires.
2. User B is added as tier-2 (3rd place, 10%) winner.
3. User B calls `DepositManagerV1#fundBountyToken` with 90,000 USDC and `_expiration = 1` second.
4. User B calls `ClaimManagerV1#permissionedClaimTieredBounty`; snapshot = 100,000 USDC, B is owed 10,000 USDC.
5. Next block User B calls `DepositManagerV1#refundDeposit`, withdrawing the 90,000 USDC; expired 10,000 USDC also refundable, leaving bounty empty.
**How found:** Code review of TieredPercentageBountyV1 close/claim logic: noticed balance snapshot is taken once and never adjusted for refunds, then reasoned that a refundable short-lived deposit could inflate the payout base.
**Exploitation:** Attacker must be a tier winner. They temporarily fund the bounty with a large short-expiration deposit to inflate the snapshot, claim their percentage of the inflated pool, then refund the deposit in a later block, draining the original expired deposit too.
**Insight:** When a payout is a percentage of a balance snapshot, check whether that balance can be temporarily inflated by deposits that are refundable after the snapshot; short expiration windows are the lever.