# Rewards are calculated as distributed even if there are no stakers, locking the rewards forever

ZivoeRewards updates reward period timestamp even with zero stakers, so rewards deposited before anyone stakes accrue to nobody and stay locked in the contract.

- Payout: Contest reward
- Severity: medium
- Program: Zivoe
- Credited: 0x73696d616f
- Disclosed: 2024-03-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/113
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:regression technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** ZivoeRewards / ZivoeRewardsVesting staking reward contracts
**Root cause:** depositReward() transfers tokens in and resets the reward period timestamp unconditionally, but the Synthetix-style accumulator only skips rate updates when _totalSupply==0, not the timestamp; elapsed time with no stakers is treated as distributed.
**Steps:**
1. Deploy ZivoeRewards, addReward(USDC, 30 days)
2. Call depositReward(USDC, 50_000e6) while totalSupply==0
3. skip(172_800) (2 days) before any stake
4. Alice stakes 5_000_000e18, skip(duration), fullWithdraw()
5. Observe ~3335 USDC remains stuck in contract (2/30 of rewards) with no way to recover
**How found:** Forked Synthetix StakingRewards and compared: noticed the zero-supply special case guards the reward rate update but not the lastUpdateTime update, then wrote a Foundry test depositing rewards before any stake to confirm stranded balance.
**Exploitation:** Any user can call ZivoeYDL.distributeYield() which pushes accumulated yield into stSTT/stJTT via depositReward even when total staked supply is zero; the reward period clock advances and that portion is permanently stranded.
**Insight:** When auditing forks of Synthetix StakingRewards, check that every state variable (rewardRate, lastUpdateTime, periodFinish) is guarded by the same zero-totalSupply condition; a partial guard silently burns rewards for the empty period.