# Dust notify resets reward vesting

Permissionless notify or deposit that resets reward rate or period, forfeiting accrued rewards

_Area: DeFi accounting and math bugs. Seen in 27 disclosed reports; latest 2026-03-19. Updated 2026-10-22._

## How it works
Reward contracts track a rate and a period end. A permissionless path recomputes that rate or period from a raw balance delta or elapsed time, without first checkpointing what users already earned. The assumption that breaks: that any balance increase is a genuine new reward and that resetting the clock is harmless. A 1-wei transfer or a call to a shared update hook then rewrites `lastUpdateTime`, `rewardPerSecond`, `periodFinish`, or a per-user start time, so accrued rewards are erased or stretched over a fresh window [E1](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-08.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-15.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-2.md)[E5](https://bugbountylibrary.com/r/cantina%3Adefi_app_february2025%3A3.2.6.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-12.md).

## Where to show up
- `_notifyReward`/`notifyRewardAmount` writing `lastUpdateTime` or `rewardPerSecond` without calling `_updateReward` first [E1](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-08.md)
- "New rewards" derived from `balanceOf(this) - accountedBalance`, so any direct transfer counts [E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-15.md)[E5](https://bugbountylibrary.com/r/cantina%3Adefi_app_february2025%3A3.2.6.md)
- Permissionless `gulp`/notify that sets `expiration = now + duration` with no minimum interval [E8](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-12.md)
- Shared `_update` hook that resets a per-user start time based on elapsed time, callable for any `to` via deposit/mint [E3](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-2.md)
- Reward asset address accepted without registry validation [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-06.md)
- `rewardReserve` not equal to `rewardRate * duration` across epoch boundaries [E7](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md)
- Per-user pending computed with the current emission rate instead of the rate at claim time [E4](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AH-4.md)

## How to review
For every path that writes rate, period, or a user start time, confirm it first checkpoints `rewardPerTokenStored`/user debt. Confirm new rewards come from an explicit accounting variable, not a raw balance delta, or that a minimum interval and nonzero threshold guard the recompute. Confirm `rewardReserve == rewardRate * duration` after every branch. Confirm the reward asset is validated against a registry. Invariant: a zero-value or 1-wei external action must not change any user's accrued reward or the remaining emission schedule.

## Variants seen
- Notify without checkpoint erases lockers' accrued rewards [E1](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-08.md)
- 1-wei donation restarts vesting at a tiny rate [E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-15.md)[E5](https://bugbountylibrary.com/r/cantina%3Adefi_app_february2025%3A3.2.6.md)
- 1-wei deposit resets victim's `avgStart`, zeroing vested rewards [E3](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-2.md)
- Repeated permissionless gulp stretches emissions indefinitely [E8](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-12.md)
- Unvalidated reward token inflates per-share accounting [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-06.md)
- Rate computed from new amount only, stranding rollover [E7](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md)
- Current-rate applied to past rewards loses value at cliffs [E4](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AH-4.md)

## Impact and severity
Rewards forfeited, delayed, or diluted for all stakers; in E6 the accounting inflation drained real quote tokens. Severity is high where the trigger is a 1-wei transfer or a single permissionless call, and worse when the reset is silent and repeatable.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-08.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-15.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-2.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AH-4.md
- E5: https://bugbountylibrary.com/r/cantina%3Adefi_app_february2025%3A3.2.6.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-06.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-05.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-12.md