# Repeatable claim inflates reward accumulator

Claim, distribute or bonus paths callable repeatedly without resetting per-claim state or capping payout

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-09-30. Updated 2026-10-23._

## How it works
A reward or bonus path assumes each call pays out once and leaves shared state consistent. The assumption breaks when the function mutates a global accumulator or credits a balance on every call while the caller's own pending is already zeroed, or when no gate limits how often it runs. Each extra call then adds value that was never earned, and the shared index or pool balance drifts from reality.

## Where it shows up
- Claim/distribute/rebase functions that write a global index (e.g. accRewardsPerShare) on every call, including branches where the caller's own pending is zero [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md)
- Expired or empty positions still routed through the accumulator update [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md)
- Public deposit/withdraw/distribute with no caller gate or rate limit [E2](https://bugbountylibrary.com/r/dhl%3A20260930-mus.md)[E3](https://bugbountylibrary.com/r/dhl%3A20250525-dumbo.md)
- First-deposit or signup bonuses paid twice: once as a refund, once as a redeemable balance [E2](https://bugbountylibrary.com/r/dhl%3A20260930-mus.md)
- Reward minting that can be compounded into a stake the caller controls within one transaction [E3](https://bugbountylibrary.com/r/dhl%3A20250525-dumbo.md)

## How to review
For each payout path, ask: is the state mutation idempotent for a caller with nothing pending? Does any invariant cap total payout (refund plus redeemable) at the amount deposited? Can distribute/claim be looped in one transaction to grow a caller-owned position? The property that must hold: sum of value paid to a caller over any number of calls never exceeds value earned, and the global accumulator only moves when a real, non-zero entitlement is settled.

## Variants seen
- Expired-bond claim re-adds pending delta to the shared index, inflating other holders' rewards [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md)
- First-deposit bonus double-counted as ETH refund plus withdrawable allocation, no cap on total payout [E2](https://bugbountylibrary.com/r/dhl%3A20260930-mus.md)
- Permissionless distributor looped to mint and compound rewards into caller's stake [E3](https://bugbountylibrary.com/r/dhl%3A20250525-dumbo.md)

## Impact and severity
High: full drain of reward assets [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md), pool drained via deposit-withdraw cycle [E2](https://bugbountylibrary.com/r/dhl%3A20260930-mus.md), repeatable minting converted to profit [E3](https://bugbountylibrary.com/r/dhl%3A20250525-dumbo.md). Worse when the path is permissionless and compoundable in a single transaction, and when no cap ties payout to deposit.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260930-mus.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250525-dumbo.md