# ````depositReward()```` with zero amount to get reward tokens stuck in ````ZivoeRewards```` contracts

Permissionless depositReward(0) on ZivoeRewards repeatedly truncates rewardRate via integer division, locking 654 USDC / 6.6 WBTC of staker rewards in the contract.

- Payout: Contest reward
- Severity: high
- Program: Zivoe
- Credited: Audinarey
- Disclosed: 2024-03-19
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/129
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AH-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** ZivoeRewards (stZVE) staking reward contract, depositReward()
**Root cause:** rewardRate = reward.div(rewardsDuration) truncates; calling depositReward with reward=0 while a period is active recomputes rewardRate from leftover, discarding the remainder each time and shrinking total distributable rewards.
**Steps:**
1. Deploy core, add USDC/WBTC as reward tokens with 365-day duration
2. Fund zvl with 1000 USDC / 10 WBTC and call depositReward to seed rewards
3. Stake as sole staker (alice)
4. Loop 20 times: `vm.warp(timestamp += 12); stZVE.depositReward(USDC, 0);` (and separately WBTC)
5. Warp past periodFinish, call getRewards()
6. Observe alice receives ~346 USDC of 1000 (654 locked); ~3.4 of 10 WBTC (6.6 locked)
**How found:** Code reading of depositReward's rewardRate math (L233/L237) spotted integer division truncation; hypothesis that repeated recomputation with reward=0 discards leftover each call, confirmed with a Foundry PoC on a mainnet fork quantifying locked funds for 6- and 8-decimal tokens.
**Exploitation:** Attacker needs no capital or privilege: depositReward is permissionless, so anyone can spam zero-amount calls each block during an active reward period, repeatedly truncating rewardRate and permanently stranding a large fraction of reward tokens in the contract, denying yield to stakers.
**Insight:** Any permissionless function that recomputes a rate via division (reward/duration) can be griefed by calling it with zero input to repeatedly truncate the remainder; check reward-rate setters for missing access control plus precision loss, especially on low-decimal tokens where dust is large.