# The claimable rewards amount for borrowers decreases over time

RewardsController computes borrower fixed borrow shares from live floating debt, so claimable rewards shrink over time unless the index is refreshed.

- Payout: Contest reward
- Severity: medium
- Program: Interest Rate Model
- Credited: Trumpero
- Disclosed: 2024-04-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/98
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** RewardsController / Market fixed borrow share accounting
**Root cause:** accountFixedBorrowShares converts fixed principal to shares via previewRepay using current totalFloatingBorrowAssets, which grows with accrued floating interest, so fixed borrow shares (and thus reward weight) decrease over time.
**Steps:**
1. Deploy protocol; ALICE and BOB each borrowAtMaturity(4 weeks, 1 ether, 20 ether).
2. Warp 1 week; allClaimable(ALICE) == allClaimable(BOB).
3. Loop days 1..84: warp and call rewardsController.handleBorrow(BOB) to refresh BOB's index.
4. Warp to 12 weeks; allClaimable(BOB) > allClaimable(ALICE) despite identical positions.
**How found:** Code reading of claim() -> accountBalanceOperations -> accountFixedBorrowShares, noticing previewRepay depends on totalFloatingBorrowAssets which increases with time; confirmed with a differential test between a passive and an active borrower.
**Exploitation:** Borrower who never touches their position loses a portion of accrued rewards because their fixed borrow shares are recomputed lower at claim time; a borrower who refreshes the index frequently captures more.
**Insight:** When reward weight is derived from a share balance that is itself a function of live debt/interest state, check whether that share value is monotonic; any conversion through previewRepay/previewBorrow makes historical reward accounting time-dependent.