# Reward eligibility ignores time or active stake

Reward math keyed to truncated timestamps, cumulative totals, or unbounded stake inputs instead of time-weighted active balance

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-03-19. Updated 2026-10-24._

## How it works
Reward systems assume a balance counted toward a reward was actually held, at risk, for the reward period. That assumption breaks when eligibility comes from something other than time-weighted active stake: a timestamp rounded down to an epoch boundary, a cumulative total that never decrements, or a user-supplied stake input with no bounds. A balance held for an instant, or never held at all, then earns as if it were held for the whole period.

## Where it shows up
- Reward epochs computed by truncating timestamps to week/epoch start, so any balance at any instant counts for the full epoch [E1](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-01.md)
- Pending reward formulas that read a global total (e.g. total contributed) rather than per-user time-weighted stake [E2](https://bugbountylibrary.com/r/dhl%3A20260319-revamp.md)
- Referral/upline counters fed by cumulative deposit totals that include withdrawn amounts [E3](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md)
- Stake entry points accepting user-supplied quantity and end date without bounds checks [E4]
- Any reward cap or threshold reachable without proportional time or risk [E2](https://bugbountylibrary.com/r/dhl%3A20260319-revamp.md)

## How to review
Find the exact variable that gates reward eligibility and ask two questions: does it decrease on withdrawal, and does it weight by duration? The invariant: reward earned is proportional to active stake times time held, and no deposit/withdraw cycle within one epoch can earn more than a continuously held position of the same size. Check that epoch bucketing does not collapse sub-epoch holdings into full-epoch credit [E1](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-01.md); that per-user reward math does not read global totals [E2](https://bugbountylibrary.com/r/dhl%3A20260319-revamp.md); that referral counters use active, not cumulative, balances [E3](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md); and that stake inputs are validated against minimums and sane ranges [E4].

## Variants seen
- Epoch truncation: deposit just before the week boundary, withdraw just after, collect a full week [E1](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-01.md)
- Global-total inflation: a helper address's large contribution pushes a first address's pending reward to its 2x cap [E2](https://bugbountylibrary.com/r/dhl%3A20260319-revamp.md)
- Cumulative-vs-active accounting: withdrawn totals still count toward referral team size, feeding referral bonuses [E3](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md)
- Missing input validation (adjacent): minimal stake with zero end date still qualifies for outsized reward [E4]

## Impact and severity
Direct reward pool drains: ~236 BNB [E4], 2.99 BNB [E2](https://bugbountylibrary.com/r/dhl%3A20260319-revamp.md), 61k USD [E3](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md), and full-week CANTO rewards for sub-epoch deposits [E1](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-01.md). Severity is high because the drain repeats and scales with pool size. Worse when caps or global totals let one actor amplify another's reward [E2](https://bugbountylibrary.com/r/dhl%3A20260319-revamp.md), and when counters never decrement so farming loops are unbounded [E3](https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-01.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260319-revamp.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250813-grizzifi.md