# Execution Layer rewards are lost

RioLRTRewardDistributor only distributes ETH via its receive() function, so Execution Layer rewards credited directly to the contract (no call) get stuck and are lost.

- Payout: Contest reward
- Severity: medium
- Program: Rio Network Core Protocol
- Credited: fnanni
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/174
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** RioLRTRewardDistributor Solidity contract (fee recipient)
**Root cause:** EL rewards are credited to the fee_recipient address by balance update, not a transfer, so receive() never fires; the contract has no other path to split/distribute its ETH balance.
**Steps:**
1. Set RioLRTRewardDistributor as validator fee_recipient per operator docs.
2. Trigger a local block proposal (mev-boost fallback/timeout, min-bid not met, or bid-compare-factor fallback) so priority fees/MEV are credited directly to the contract.
3. Observe address(this).balance increases without receive() being invoked.
4. No function exists to split the balance to treasury/operatorRewardPool/depositPool, so funds are stranded.
**How found:** Read the docs claiming the Reward Distributor receives ETH via the Execution Layer, then reasoned from Solidity semantics that coinbase/fee_recipient credits update balance without calling receive(), so the receive()-only distribution logic misses them.
**Exploitation:** Not an attacker-driven exploit; occurs naturally when validators fall back to local block production, causing priority fees and MEV to be credited to the contract with no distribution path.
**Insight:** When a contract is meant to be a fee_recipient/coinbase, remember EL rewards are balance credits not transfers — receive()/fallback never run, so any accounting keyed on those hooks silently misses funds; check for a manual sweep function.