# `StakingRewardsManager::topUp(...)` Misallocates Funds to `StakingRewards` Contracts

StakingRewardsManager.topUp ignores the indices array and uses loop counter i, so rewards fund the wrong StakingRewards contracts.

- Payout: Contest reward
- Severity: high
- Program: Telcoin
- Credited: Aamirusmani1552
- Disclosed: 2024-01-04
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-telcoin-judging/issues/16
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-telcoin%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** StakingRewardsManager.topUp (Solidity contract)
**Root cause:** The loop indexes stakingContracts[i] using the loop counter instead of stakingContracts[indices[i]], so the caller-supplied indices array is ignored.
**Steps:**
1. Deploy 3 StakingRewards contracts via createNewStakingRewardsContract
2. Approve rewardToken to StakingRewardsManager for tokenAmount * indices.length
3. Call topUp(deployer, [0, 2])
4. Observe stakingContract0 and stakingContract1 each receive 100 tokens while stakingContract2 receives 0
**How found:** Manual review of the topUp loop noticing the indices parameter is never used to index stakingContracts; confirmed with a Hardhat test passing indices [0,2] and observing funds land on contracts 0 and 1.
**Exploitation:** An EXECUTOR_ROLE caller intending to top up contracts at indices [1,2] instead funds contracts at [0,1]; stakers of the wrong contract receive unintended rewards while intended recipients get none.
**Insight:** When a function accepts an indices array, verify every array access uses indices[i] rather than the loop counter i; a passing test with sequential indices hides the bug, so test with non-contiguous indices like [0,2].