# Reward index not synced on balance change

Balance, weight, or emission-parameter writes that skip the reward-index checkpoint first

_Area: DeFi accounting and math bugs. Seen in 74 disclosed reports; 2 confirmed bounties: $21,000 and $25,000; latest 2026-08-20. Updated 2026-10-23._

## How it works
Reward contracts track each user's share of emissions with a per-user checkpoint (reward debt, paid-per-token, or index snapshot). The invariant: before any write to a user's share balance or to a global weight/denominator, the reward index must be synced for that user. When a path mutates shares without syncing, the stored checkpoint stays stale. A fresh address with zero prior data then claims emissions accrued from index 0, or a removed participant's stale numerator keeps inflating the index. The assumption that breaks is "every balance write is preceded by a sync" — it is not enforced structurally, so any new write site can silently violate it.

## Where it shows up
- New position minted without initializing its reward-debt checkpoint to the current accumulator [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-88mph-theft-of-unclaimed-mph-rewards-bugfix-review.md)
- ERC20 share transfer that does not update reward debt, plus a claim callable for arbitrary fresh receivers [E2](https://bugbountylibrary.com/r/dhl%3A20250823-equilibriaependle.md)
- Transfer hook that exempts certain addresses (pair, zero) from fee-debt caching, which then accrue unearned fees [E3](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-05.md)
- Claim/deposit crediting a `to` recipient without calling the emission update first [E4](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-02.md)
- Function decrementing a global denominator (total weight) but leaving the per-participant numerator mapping intact [E5](https://bugbountylibrary.com/r/c4%3A2024-09-fenix-finance%3AH-01.md)
- Exit path (emergencyWithdraw) that zeroes balance without running the reward-checkpoint modifier [E7](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-02.md)
- Index updater passed post-action supply, or advancing the timestamp on a zero-supply early return [E8](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-35.md)

## How to review
Enumerate every site that writes a user share balance, a global weight, or an emission parameter. For each, confirm the codebase's sync function (update_emissions, _cacheFees, rewardPerToken checkpoint) runs first. Check denominators and numerators update together. Check the supply passed to the index updater is pre-action. False-positive check: confirm the sync is not already inside a shared modifier or `_beforeTokenTransfer` hook that every path routes through. Property: for all balance/weight mutations, the user's checkpoint equals the index at the moment of mutation.

## Variants seen
- Fresh position minted with uninitialized reward debt [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-88mph-theft-of-unclaimed-mph-rewards-bugfix-review.md)
- Share transfer skips debt update; claim for arbitrary receiver [E2](https://bugbountylibrary.com/r/dhl%3A20250823-equilibriaependle.md)
- Address-exempt hook skips fee-debt caching [E3](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-05.md)
- Claim-to-third-party skips sync [E4](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-02.md)
- Denominator decremented, numerator left stale [E5](https://bugbountylibrary.com/r/c4%3A2024-09-fenix-finance%3AH-01.md)
- Exit path skips checkpoint, zeroing pending accrual [E7](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-02.md)
- Post-action supply or zero-supply timestamp advance discards emissions [E8](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-35.md)

## Impact and severity
High: theft of other users' emissions [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-88mph-theft-of-unclaimed-mph-rewards-bugfix-review.md)[E2](https://bugbountylibrary.com/r/dhl%3A20250823-equilibriaependle.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-02.md), over-allocated and stranded funds [E5](https://bugbountylibrary.com/r/c4%3A2024-09-fenix-finance%3AH-01.md), lost pending rewards on exit [E7](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-02.md), and silently burned emissions [E8](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-35.md), plus unearned fee capture [E3](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-05.md). Severity rises when the miss is reachable by any user and the stale checkpoint spans a long accrual window.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-88mph-theft-of-unclaimed-mph-rewards-bugfix-review.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250823-equilibriaependle.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-05.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-02.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-09-fenix-finance%3AH-01.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-09.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-02.md
- E8: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-35.md