# `AlloraPendingRewardForDelegator` module account could have insufficient rewards due to truncation

Allora reputer delegator rewards record full-precision share but transfer truncated coins, so pending-reward module account accrues a shortfall over time.

- Payout: Contest reward
- Severity: high
- Program: Allora
- Credited: Kow
- Disclosed: 2024-06-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-allora-judging/issues/74
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-9
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:go technique:source-review vuln:precision-loss

**Target:** Cosmos SDK emissions module reward accounting (reputer_rewards.go)
**Root cause:** addShare = delegatorReward/totalDelegatorStakeAmountDec is stored at full precision in DelegateRewardPerShare, but only delegatorReward.SdkIntTrim() coins are moved to AlloraPendingRewardForDelegator, so recorded liabilities exceed held funds.
**Steps:**
1. In GetRewardForReputerFromTotalReward, compute delegatorReward and totalDelegatorStakeAmountDec.
2. addShare = delegatorReward.Quo(totalDelegatorStakeAmountDec) with no truncation; newShare = currentShare + addShare stored via SetDelegateRewardPerShare.
3. SendCoinsFromModuleToModule transfers sdk.NewCoin(DefaultBondDenom, delegatorReward.SdkIntTrim()) to AlloraPendingRewardForDelegator.
4. Repeat across blocks; accumulated truncation makes sum of recorded shares * stake exceed module balance.
5. Delegators calling RewardDelegateStake cannot withdraw full recorded rewards.
**How found:** Code reading of reward accounting: noticed asymmetry between full-precision share update and truncated coin transfer in the same block.
**Escalation:** Discrepancy compounds over multiple reward rounds, eventually blocking delegator withdrawals.
**Insight:** When a contract stores a per-share accumulator at full precision but moves truncated token amounts, the liability/asset mismatch compounds each epoch; audit accumulator-vs-transfer precision pairs.