# Claimed rewards not deducted from pool

Payouts credited to users but never subtracted from the global pool, accumulator, or reserve

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-11-20. Updated 2026-10-24._

## How it works
A reward or fee pool holds a global counter of what has been paid out, and each user's payout is computed from that counter divided across the current supply. The assumption that breaks: that crediting a user and debiting the pool happen together. When a user's principal is burned or a claim is paid but the global distributed counter (or reserve) is left unchanged, the same value is counted twice — once for the early claimer and again for everyone still in the pool. The denominator shrinks while the numerator stays fixed, so later payouts are inflated and can exceed what was ever accrued [E1](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md).

## Where it shows up
- Withdrawal/claim paths that burn user shares but do not decrement a `distributed`/`rewardReserve` counter [E1](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md).
- Reward math dividing by `supply - distributed` or similar shrinking denominators [E1](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md).
- `rewardRate` set from only the new amount while `rewardReserve` includes rollover or prior balance [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md).
- Reward calc reading a live pair/token balance and not updating last-claim time [E2](https://bugbountylibrary.com/r/dhl%3A20250108-lpmine.md).
- Rate/schedule recomputed on refund by dividing remaining amount by remaining periods, ignoring elapsed ones [E4](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-18.md).

## How to review
For every quantity added to a user's payout (reward, bonus, accrued interest), confirm a symmetric decrement from the global pool in the same transaction. Check the invariant `rewardReserve == rewardRate * duration` holds across epoch boundaries [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md). Confirm last-claim timestamp is written before any balance-dependent reward read [E2](https://bugbountylibrary.com/r/dhl%3A20250108-lpmine.md). On any rate recompute, verify elapsed periods are accounted for, not just remaining ones [E4](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-18.md).

## Variants seen
- Principal burned, reward counter untouched, denominator shrinks [E1](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md).
- Balance-based reward with stale timestamp enabling repeat claims [E2](https://bugbountylibrary.com/r/dhl%3A20250108-lpmine.md).
- Reserve includes rollover but rate excludes it, stranding tokens [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md).
- Refund redistributed over remaining steps re-locks vested value [E4](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-18.md).

## Impact and severity
Overpayment draining more than accrued [E1](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md), repeated claims via flash loan for ~24k USDT [E2](https://bugbountylibrary.com/r/dhl%3A20250108-lpmine.md), permanently stranded rollover rewards [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md), re-locked claimable tokens [E4](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-18.md). Severity rises when the pool is shared and drainable, and when claims are repeatable within one block.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250108-lpmine.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-18.md