# CVX/AURA distribution calculation is incorrect and will lead to loss of rewards at the end of each cliff

WAuraPools computes pending AURA using current emission cliff rate instead of rate at claim time, so users lose rewards after each cliff.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-07-12
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/109
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** WAuraPools/WConvexPools reward accounting wrapper
**Root cause:** _getAuraPendingReward applies the current cliff's reduction ratio to the whole pending balance, but rewards were actually claimed at earlier, higher emission rates; the contract never caches reward-per-token at claim time.
**Steps:**
1. User A deposits LP into WAuraPools; User B deposits later.
2. User A withdraws before cliff end; WAuraPools calls `IAuraRewarder.withdraw(amount, true)` which triggers `getReward` and claims AURA for the entire vault at the current high rate.
3. User B waits until after the cliff; `_getAuraPendingReward` recomputes B's share using the now-lower cliff reduction, yielding less (or zero) than the AURA already sitting in the contract.
4. Repeat across 500 cliffs (~6 days each) to accumulate loss.
**How found:** Code review of WAuraPools reward math; noticed withdraw passes `claim=true` to Aura Rewarder, traced getReward to confirm it claims for the whole vault, then reasoned that pending-reward calc uses current cliff rate rather than the rate at claim time.
**Exploitation:** No attacker; loss occurs passively whenever any user withdraws and triggers a vault-wide claim, then other users withdraw after a cliff boundary and are paid at the reduced rate.
**Insight:** When a wrapper claims rewards for the whole vault on any user's withdraw, check whether per-user accounting uses the emission rate at claim time or the current rate; cliff-based emissions make this divergence exploitable/lossy.