# Reward misrouting to wrong owner

Batch or edge-case reward paths that skip original-owner resolution and pay the wrong party

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-03. Updated 2026-11-02._

## How it works
A reward or unstaked-principal path resolves the recipient with a simpler rule than the canonical path. The single-item path knows about a special case (split pairs, escrowed/delegated tokens, AVM-managed IDs); the batch path or an edge-case close path does not. The result is that value is credited to a contract or pool address instead of the real owner, and whoever can pull from that address keeps it. The broken assumption is "the recipient is just `ownerOf()`" or "the unstaked principal goes back to the position holder" — both fail when ownership was remapped or the position was split.

## Where it shows up
- Parallel entry points: `claim()` vs `claim_many()`, single withdraw vs batch withdraw, one NFT vs a pair.
- Recipient resolution that differs between paths: one uses `ownerOf()`, the other also checks a delegation/escrow/original-owner mapping.
- Wrapper code that sweeps `balanceOf(this)` or `balanceOf(pool)` instead of an exact computed amount.
- External staking integrations where a close/withdraw path sends principal to a party other than the caller.
- Contracts holding yield-bearing tokens (cTokens/aTokens) on behalf of users with no `claimComp`/`claim` call routed to the beneficiary.

## How to review
- Enumerate every path that pays out (single, batch, edge-case close). For each, confirm the recipient is resolved by the same rule, including any original-owner/delegation override.
- The invariant: for every payout path, the credited address equals the beneficial owner under all ownership states (transferred, split, escrowed, delegated).
- Check that sweeps use an exact amount, not the contract's whole balance; a sweep of `balanceOf(this)` turns any stray credit into a theft.
- For external integrations, read the external contract's close/withdraw edge cases and confirm who receives principal.
- For contracts holding yield tokens, confirm a claim path exists and forwards to owners.

## How finders spotted it
- Read the external `ApeCoinStaking._withdrawPairNft`, found the split-pair case where unstaked APE goes to the BAYC owner, then matched it against the wrapper's whole-balance sweep [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-06.md).
- Noticed the contract holds cTokens and a sibling contract has `claimComp`, but this one never calls it [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md).
- Diffed `claim()` against `claim_many()` and saw the AVM original-owner branch present in one and missing in the other [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md).

## Variants seen
- Split-pair close sends principal to the wrong pool, then a sweep drains it [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-06.md).
- Rewards accrue to a contract that never claims or forwards them [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md).
- Batch claim omits the original-owner remap that the single claim applies [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md).

## Impact and severity
E1 lets a new BAKC owner trigger a close whose unstaked APE lands in a pool any staker can sweep — direct theft of principal [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-06.md). E2 silently loses supplier rewards to position owners [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md). E3 misdirects expired-lock rewards to the AVM contract instead of the user [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md). Impact rises when the misrouted value is principal rather than yield, and when a sweep makes it claimable by an arbitrary party [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-06.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-06.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md