# Reward count includes invalid entries

Payout loops and fee schedules that count claimed, reverting, or skipped entries as successful

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-03-31. Updated 2026-10-29._

## How it works
A contract computes a payout, fee, or price from a *count* of entries it intends to process, but the count includes entries that will not actually succeed: already-claimed items, entries whose hooks revert, or entries skipped by an early exit. The pricing or payout formula then assumes more work happened than really did, so the amount paid out or charged is wrong. The broken assumption is that "number of entries submitted" equals "number of successful state changes."

## Where it shows up
- A loop that iterates a submitted list and increments a counter before confirming each item succeeds.
- Auction or VRGDA-style pricing that advances a schedule per index rather than per successful claim.
- Fee-splitting loops with `break`/early `return` on an invalid entry, skipping later checks.
- Batched sends (`BankMsg::Send`, multi-transfer) where one failing element reverts the whole batch.
- Balances shared across payouts where an external party can reduce the balance (force-transfer denoms).

## How to review
Trace the counter or schedule variable and confirm it only advances on a real, committed state change. The invariant: *the count fed into pricing/payout must equal the number of entries that actually succeed in this transaction.* For batched sends, check whether any single element can fail and whether the contract's balance can be reduced by an outside actor between accounting and send. For fee loops, confirm no early exit skips a later state-mutating check.

## Variants seen
- Already-claimed or reverting prizes counted as claims, skewing VRGDA fee downward [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-11.md).
- Early `break` on invalid creator share skips seller-recipient detection, misrouting fees [E3](https://bugbountylibrary.com/r/c4%3A2022-11-foundation%3AM-02.md).
- Batched reward send plus externally drainable tokenfactory balance bricks claims and closure [E1](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-09.md).

## Impact and severity
Underpaid claimers [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-11.md), misrouted marketplace fees [E3](https://bugbountylibrary.com/r/c4%3A2022-11-foundation%3AM-02.md), and permanently stuck rewards or blocked farm closure [E1](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-09.md). Severity rises when the failure is permanent (bricked claims) or when an outside party can trigger it cheaply (griefing via force-transfer).

## Why fixes fail
Counting submitted entries instead of successful ones leaves the schedule skewed whenever any entry no-ops; fixing only the payout amount without fixing the count leaves the next batch wrong.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-09.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-11.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-11-foundation%3AM-02.md