# Stale reward claim state

Claim guards keyed on mutable IDs, unreset accruals, or non-idempotent accumulators that pay rewards twice

_Area: DeFi accounting and math bugs. Seen in 48 disclosed reports; one confirmed bounty: $70,000; latest 2026-09-05. Updated 2026-10-23._

## How it works
A claim path pays from stored claim state that no longer matches what the user accrued. The marker may be keyed on something mutable, never reset after payment, mutated on every call, or checked before it is set. The invariant that must hold: cumulative payouts to a user never exceed their accrued entitlement, and the global reward pool is decremented by exactly what is paid. When the marker drifts from reality, the same rewards become payable again, or payable by someone who never earned them. This is corrupted claim/dedup state, not generic rounding or fee math.

## Where it shows up
- A global accumulator (e.g. accRewardsPerShare) mutated on every claim call, including calls on a zeroed or expired position [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md).
- Claim dedup keyed on a token ID, NFT, or position that can be merged, burned, or re-minted carrying the same balance [E2](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-09.md).
- Batch-claim loops that check claim status before the loop but mark claimed only after it [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-logic-error-bugfix-review.md).
- A "claimed" status a cheap re-entry (dust pledge) can flip back to unclaimed [E4](https://bugbountylibrary.com/r/dhl%3A20260905-dhc.md).
- A claimable() branch returning a fixed amount without subtracting already-claimed [E5](https://bugbountylibrary.com/r/sherlock%3A2023-12-truflation%3AH-1.md).
- Accrued amount read and paid but never written back to zero after a successful transfer [E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-1.md).
- Reward pool credited to users but never decremented on withdrawal, so the distributed counter stays fixed while the denominator shrinks [E7](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md).
- Reward accounting that credits both parties on a transfer, so a self-transfer mints rewards [E8](https://bugbountylibrary.com/r/dhl%3A20250114-idolsnft.md).

## How to review
For every claim path, trace the stored claim value: is it initialized when the position is created or increased, monotonically accumulated, and keyed on something immutable? Confirm the reward basis is a checkpointed snapshot, not a live balance a merge or transfer can duplicate. In batch loops, verify each item is marked claimed inside the loop, per item, before totals are computed. Check that a claimed status cannot be reset by any cheap state transition, and that any grant/transfer helper's returned remaining balance is written back. Verify every quantity added to a payout is symmetrically decremented from the global pool. Test same-block repeat claims, duplicate IDs in one array, self-transfers, and claim-early vs claim-late scenarios.

## Variants seen
- Non-idempotent global accumulator mutation on a zeroed/expired position [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md).
- Mutable-ID keying with live-balance reward basis [E2](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-09.md).
- Check-then-act gap in a batch claim loop [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-logic-error-bugfix-review.md).
- Claimed status resettable by dust re-entry [E4](https://bugbountylibrary.com/r/dhl%3A20260905-dhc.md).
- Fixed-amount claimable branch ignoring already-claimed [E5](https://bugbountylibrary.com/r/sherlock%3A2023-12-truflation%3AH-1.md).
- Accrued balance never reset after grant [E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-1.md).
- Asymmetric pool decrement on LP withdrawal [E7](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md).
- Self-transfer reward mint [E8](https://bugbountylibrary.com/r/dhl%3A20250114-idolsnft.md).

## Impact and severity
Drains of reward vaults and insolvency: all BondNFT assets [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md), WETH [E2](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-09.md), lottery payout [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-logic-error-bugfix-review.md), ~$71.8K USDT [E4](https://bugbountylibrary.com/r/dhl%3A20260905-dhc.md), LEND reserves [E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-1.md), over-paid LP rewards [E7](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md), 97 stETH [E8](https://bugbountylibrary.com/r/dhl%3A20250114-idolsnft.md). Severity is high when the guard is fully bypassable and the vault holds real funds; worse when repeatable in one block or via flash loan.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-05.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-09.md
- E3: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-logic-error-bugfix-review.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260905-dhc.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-12-truflation%3AH-1.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-1.md
- E7: https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.7.md
- E8: https://bugbountylibrary.com/r/dhl%3A20250114-idolsnft.md