# Donation-funded rewards claimable same transaction

Reward pools credited by donations and claimable by a same-block entrant using temporary balance

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; one confirmed bounty: $95,000; latest 2025-06-19. Updated 2026-10-29._

## How it works
A pool credits rewards or dividends from tokens sent directly to it (donations) rather than from tracked deposits. The accounting treats the live balance as the source of truth, so any balance present at claim time counts as earned. An entrant who holds tokens only briefly — flash-borrowed or transferred in — can realize the donated value in the same transaction, then exit, leaving the pool short. The broken assumption: that a balance held at claim time reflects a real, time-weighted stake.

## Where it shows up
- Reward or dividend math reading `balanceOf(address(this))` or live reserves instead of a cached, per-user accounting value [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-yield-protocol-logic-error.md)[E3](https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md)
- Pools that accept direct transfers as funding with no deposit event or snapshot
- Claim logic with no minimum holding period, checkpoint, or per-block accrual
- First-deposit or initialization branches that assume reserves are dust [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-2.md)
- Per-module or per-pool flags (e.g. `notFirstDeposit`) that are not reset when a module is reused or pre-funded [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-2.md)

## How to review
Identify every place payout is derived from a live balance. The invariant: a user's claimable amount must depend only on values recorded at deposit time (cached shares, checkpoints, time-weighted stake), never on tokens that arrived by transfer. Check that donations are either excluded from reward math or distributed only across a snapshot taken before the donation. For initialization branches, confirm the dust assumption holds at the moment the branch runs, including after module swaps that pre-fund the contract [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-2.md).

## Variants seen
- Redemption priced off live `pool.balanceOf`, inflated by direct transfer [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-yield-protocol-logic-error.md)
- Donation-funded dividends realized by a same-transaction donate/buy/sell/withdraw cycle [E3](https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md)
- First-deposit dust-removal withdrawing full liquidity after a module is pre-funded [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-2.md)

## Impact and severity
Direct loss of pool funds: full liquidity sent to a manager and locked via DoS [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-2.md), base tokens drained from strategies [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-yield-protocol-logic-error.md), and excess tokens extracted for profit [E3](https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md). Severity is high where the pool holds other users' capital; worse when recovery is blocked (manager set to zero) or when flash loans remove the capital barrier to entry.

## Why fixes fail
Per-module flags left unreset after reuse kept the first-deposit assumption false [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-2.md); caching only the numerator while still reading live balances leaves the same inflation path open [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-yield-protocol-logic-error.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-2.md
- E2: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-yield-protocol-logic-error.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md