# `QVSimpleStrategy`: If someone fund a pool when the fund is partially/fully distributed, part of the fund may be locked

Funding a QVSimpleStrategy pool after partial distribution increases poolAmount but already-paid recipients are flagged paidOut, locking the added funds.

- Payout: Contest reward
- Severity: medium
- Program: Gitcoin
- Credited: 0xkaden
- Disclosed: 2023-09-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-Gitcoin-judging/issues/446
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Allo fundPool / QVBaseStrategy distribution logic
**Root cause:** fundPool increases poolAmount at any time, but _distribute marks recipients paidOut; funds added after distribution inflate poolAmount without a corresponding unpaid recipient set, so the added amount cannot be paid out.
**Steps:**
1. Pool manager calls `_distribute` on QVBaseStrategy, paying some recipients and setting their `paidOut=true`.
2. Anyone calls `Allo::fundPool`, which calls `BaseStrategy::increasePoolAmount()` raising `poolAmount`.
3. `QVBaseStrategy::_getPayout` computes payouts from `poolAmount`, but already-distributed recipients are skipped due to `paidOut` flag.
4. Remaining unpaid recipients cannot absorb the added funds; excess remains locked in the strategy.
**How found:** Code reading of fundPool/increasePoolAmount versus _distribute's paidOut flagging; noticed poolAmount is mutable at any time while distribution state is monotonic.
**Exploitation:** No attacker profit; griefing/accidental loss where a funder adds tokens after distribution begins and those tokens become unrecoverable because no recoverFund exists.
**Insight:** When a pool's payout denominator (poolAmount) is mutable but per-recipient paid flags are permanent, check whether late deposits can ever be claimed; look for missing recover/sweep functions in streaming or distribution strategies.