# Reward base reduced before accrual

Check whether reward/fee accrual uses post-mutation balances, stale weights, or full share counts instead of the correct pre-change base

_Area: DeFi accounting and math bugs. Seen in 23 disclosed reports; one confirmed bounty: $4,000; latest 2026-08-20. Updated 2026-10-22._

## How it works
Reward and fee math divides a pool of value by a base (staked balance, share count, weight, or index). The bug is that the base or the elapsed interval is wrong at the moment of accrual: state is mutated before the accumulator divides by it, a weight is changed before the stale interval is settled, or a payout is computed from a stored balance rather than the amount actually moved. The invariant that breaks: accrual must use the base as it stood during the interval being paid, and payouts must reflect the amount actually burned/withdrawn.

## Where it shows up
- Accumulator updates that divide by a variable mutated earlier in the same function [E5](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-4.md).
- `(now - lastUpdate) * currentWeight` where weight is admin-settable [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-3.md).
- Payout computed from `shares[msg.sender]` instead of the burned amount [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pods-finance-logic-error-bugfix-review.md).
- Shares burned at request time, removed from fee denominator before settlement [E4](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AH-6.md).
- Cumulative counters (totalInvested) feeding team/referral logic that never decrement [E6](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md).
- A slash/scale index reused as a multiplier in unrelated reward weights [E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md).
- A burn path that ignores the vested fraction a view function already credits [E8](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.4.md).
- Divisor/reciprocal formulas that diverge from a documented linear spec [E2](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-07.md).

## How to review
For each accrual, identify the base and the interval, then confirm the base equals the value held during that interval, not after the triggering mutation. Check ordering: any state change to stake, weight, or shares must be preceded by settling the accumulator. Diff full-exit vs partial-exit formulas and confirm both pay only for the amount actually moved. Trace every consumer of a slash/scale index. Compare on-chain arithmetic against the published formula by plotting both curves.

## Variants seen
- Weight set before updateAll, retroactive over stale interval [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-3.md).
- Non-linear multiplier vs linear spec [E2](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-07.md).
- Partial unmint pays on full share balance [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pods-finance-logic-error-bugfix-review.md).
- Queued shares escape fee denominator [E4](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AH-6.md).
- Deposit included in reward denominator before distribution [E5](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-4.md).
- Withdrawn totals inflate referral counts [E6](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md).
- Slash index double-penalizes reward weight [E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md).
- Vested rewards slashed [E8](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.4.md).

## Impact and severity
Inflated emissions, drained reward pools, lost staker rewards, and fee avoidance; one case drained 61k USD [E6](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md). Severity rises when the wrong base is repeatedly exploitable or silently compounds across consumers [E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-3.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-07.md
- E3: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pods-finance-logic-error-bugfix-review.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AH-6.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-4.md
- E6: https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md
- E7: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md
- E8: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.4.md