# Anyone could call `depositReward` with zero reward to extend the period finish time

ZivoeRewards.depositReward is permissionless and accepts zero reward, letting anyone reset periodFinish and dilute reward rate for stakers.

- Payout: Contest reward
- Severity: high
- Program: Zivoe
- Credited: 0brxce
- Disclosed: 2024-03-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/11
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AH-1
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** ZivoeRewards staking rewards contract (depositReward)
**Root cause:** depositReward lacks access control and does not reject reward==0; the else branch recomputes rewardRate from leftover and unconditionally sets periodFinish = now + rewardsDuration, so a zero deposit still extends the finish time.
**Steps:**
1. Deploy/use ZivoeRewards with an active DAI reward stream (depositReward_DAI(stZVE, 1)).
2. Read rewardData(DAI) to record periodFinish.
3. vm.warp forward 1 day.
4. Call depositReward(DAI, 0) from any address.
5. Observe new periodFinish = now + rewardsDuration, i.e. extended by 1 day; rewardRate diluted by leftover/duration.
**How found:** Code review of depositReward: noticed no access modifier and that periodFinish is set unconditionally regardless of reward amount, then wrote a Foundry test depositing 0 after warping 1 day to confirm the extension.
**Exploitation:** Attacker repeatedly calls depositReward(token, 0) at low gas cost to push periodFinish forward indefinitely, spreading the same leftover rewards over a longer window and lowering rewardRate so stakers earn less per unit time.
**Escalation:** Repeated zero-value calls extend the finish time indefinitely, monotonically decreasing the effective reward rate.
**Insight:** In Synthetix-style StakingRewards forks, check whether depositReward/notifyRewardAmount is permissionless and whether a zero-amount call still rewrites periodFinish and rewardRate; a zero deposit that resets the period is a griefing/dilution vector.