# Integer overflow when calculating rewards

Gamma Staking scales cumulatedReward by 1e36; with tiny lockedSupplyWithMultiplier, reward math overflows uint256 and bricks staking/withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Gamma Staking
- Credited: joicygiore
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-gamma-staking-judging/issues/207
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-gamma-staking%3AM-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Solidity staking contract (Lock.sol) reward accounting
**Root cause:** cumulatedReward is scaled by 1e36 and divided by lockedSupplyWithMultiplier; when locked supply is tiny (e.g. 1 wei), cumulatedReward becomes ~1e54 and multiplying by a user's lockedWithMultiplier overflows uint256.
**Steps:**
1. Attacker stakes `1 wei` of staking token as first staker
2. Attacker deposits `1e18` reward token and calls `notifyUnseenReward()`
3. `_notifyReward` computes `newReward = 1e18 * 1e36 / 1 = 1e54`, setting `cumulatedReward = 1e54`
4. Any user with `1e18` lockedWithMultiplier triggers `_earned`: `1e54 * 1e18 = 1e72`, near uint256 max (~1e78); with 1000e18 amounts it overflows
5. Overflow reverts reward calc used by stake/exit/getReward, bricking the contract
**How found:** Code review of Masterchef-style reward accounting; noticed 1e36 scaling combined with division by lockedSupplyWithMultiplier and the existing zero-supply guard, hypothesizing small-supply states produce oversized cumulatedReward.
**Exploitation:** Griefing: attacker frontruns as first staker with minimal stake, inflates cumulatedReward via reward notification so subsequent reward calculations overflow and revert, locking all users' stakes and rewards until redeploy.
**Escalation:** Overflow propagates to staking, early/late exit, and reward claims, bricking the whole protocol rather than a single user.
**Insight:** When auditing Masterchef-derived reward math, check the precision scale factor against the divisor's realistic minimum: a 1e36 scale with a guard only for zero supply leaves 1-wei supply states that overflow downstream multiplications.