# Loss of rewards due to continuous griefing attacks on L2 environment

Permissionless claimRewardTokens on L2 lets griefers claim every block, rounding reward-per-share to zero and losing all vault rewards.

- Payout: Contest reward
- Severity: high
- Program: Leveraged Vaults
- Credited: nirohgo
- Disclosed: 2024-06-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/61
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:precision-loss vuln:reward-distribution

**Target:** VaultRewarderLib reward claim/emission accounting
**Root cause:** accumulatedRewardPerVaultShare divides tokensClaimed*1e8 by totalVaultSharesBefore; tiny per-block claims (or tiny timeSinceLastAccumulation) round down to zero, discarding rewards.
**Steps:**
1. Deploy on L2 (Arbitrum) where gas is cheap.
2. Call permissionless `claimRewardTokens` every block, invoking `_claimVaultRewards` -> `_executeClaim`.
3. Each call yields tokensClaimed < totalVaultSharesBefore/1e8, so `(tokensClaimed*1e8)/totalVaultSharesBefore` truncates to 0.
4. Repeat each block so `timeSinceLastAccumulation` stays tiny, zeroing emission accumulation in `_getAccumulatedRewardViaEmissionRate`.
5. Rewards are never credited to vault users.
**How found:** Code review of reward accounting math: noticed integer division by totalVaultSharesBefore and reasoned that small numerators from frequent claims/accumulations truncate to zero, especially cheap on L2.
**Exploitation:** Attacker (or even normal users claiming each block) repeatedly triggers claim/accumulation with minimal elapsed time; each increment rounds to zero, so the entire reward stream is lost while attacker spends only L2 gas.
**Escalation:** Loss scales with TVL: larger totalVaultSharesBefore makes rounding-to-zero easier, so all rewards for the period can be lost.
**Insight:** When reward-per-share uses integer division by total shares, check whether an attacker can shrink the numerator (per-call claimed amount or elapsed time) below the divisor by calling a permissionless accrual function frequently; L2 gas makes this griefing cheap.