# Forwarding yield in `OCL_ZVE` is possible a lot more often than the enforced 30 days

OCL_ZVE.forwardYield() called before pushToLockerMulti sets nextYieldDistribution to 30 days, letting anyone bypass the 30-day yield-forwarding cooldown.

- Payout: Contest reward
- Severity: medium
- Program: Zivoe
- Credited: 0xpiken
- Disclosed: 2024-03-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/55
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-4
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** OCL_ZVE locker contract (Solidity, UniswapV2 LP yield forwarder)
**Root cause:** nextYieldDistribution defaults to 0; forwardYield() increments it by 30 days instead of setting block.timestamp+30 days, so an early call leaves it at 30 days, permanently below block.timestamp.
**Steps:**
1. Deploy OCL_ZVE locker; nextYieldDistribution == 0.
2. Before pushToLockerMulti, call `forwardYield()`: require(block.timestamp > 0) passes.
3. fetchBasis() returns amount=0, basis=0, so `if (amount > basis)` skips _forwardYield.
4. Last line sets `nextYieldDistribution += 30 days` => 30 days.
5. Now block.timestamp > 30 days always, so `forwardYield()` is callable repeatedly by anyone.
**How found:** Code reading of forwardYield()'s require against nextYieldDistribution and noticing the default 0 value plus the += 30 days increment rather than an absolute timestamp assignment.
**Exploitation:** Any user calls forwardYield() in the window between locker deployment and the admin's pushToLockerMulti, permanently breaking the 30-day rate limit on yield forwarding.
**Insight:** When a cooldown uses `x += period` on a variable that defaults to 0, check whether the first call can happen before initialization; an early call anchors the schedule to epoch 0 instead of now.