# Momentary balance earns full-period rewards

Reward math reads live balance, supply, or score instead of the value held during the accrual interval

_Area: DeFi accounting and math bugs. Seen in 66 disclosed reports; one confirmed bounty: $20,750; latest 2026-05-17. Updated 2026-10-23._

## How it works
Reward accrual assumes the balance, supply, or score it reads represents the whole elapsed interval. When that figure is sampled live — at claim, deposit, or checkpoint time — instead of being snapshotted when state last changed, a value held for one block is credited as if it existed for the entire period. The broken assumption: "current value == value over the elapsed interval." Any deposit, transfer, or state change landing before the reward updater runs gets folded into past rewards. The invariant: for every accrual interval, the balance/supply/score used must equal the value that held during that interval.

## Where it shows up
- Reward updater reads `address(this).balance` or `totalSupply()` after an incoming deposit is already received [E1](https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-18.md)
- Permissionless call snapshots shares, then claim reads current balance with no holding period [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-6.md)
- Share price sampled at deposit/withdraw time around a TVL jump from a permissionless claim [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md)
- Open+claim atomic in one block, payout sized from pool balance not time-weighted stake [E4](https://bugbountylibrary.com/r/dhl%3A20260517-seatoken.md)
- Reward hook reads a stakeTracker balance already incremented by the mint/transfer hook [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-10.md)
- Checkpoint applies freshly computed effective balance to the elapsed interval instead of the stored previous balance [E6](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.1.1.md)
- Reward weights by global elapsed time, never tracking when the user actually deposited [E7](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.1.md)
- Lump-sum emission set for a single second and accrued against current totalStaked [E8](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.6.md)

## How to review
Name the exact ordering per variant. E1/E5: does the reward updater run before or after the balance mutates? E2/E4: can mint-snapshot-claim (or open+claim) complete in one transaction, and is payout sized from pool balance rather than time-weighted stake? E3: is share price sampled at deposit/withdraw time around a permissionless TVL jump? E6: does the checkpoint use the stored previous balance for the elapsed range? E7: is per-user accrual start tracked? E8: is stake weight time-averaged or snapshot? Test it: snapshot the value at interval start, mutate it, run the updater, and assert the credited amount matches the start value, not the live one. False positive: a live read is safe when the updater provably runs before any state mutation on every path, or a lockup makes momentary balances worthless — e.g. `require(block.timestamp >= depositTime + LOCK, "locked")` before claim.

## Variants seen
- Deposit counted as unprocessed rewards before shares minted [E1](https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-18.md)
- Permissionless snapshot then same-tx claim [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-6.md)
- Share price sandwiched around a TVL jump [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md)
- Same-block open+redeem drains distributor [E4](https://bugbountylibrary.com/r/dhl%3A20260517-seatoken.md)
- Hook ordering inflates earned() from already-mutated balance [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-10.md)
- Retroactive boost applied to past timestamps [E6](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.1.1.md)
- Global-elapsed-time weighting ignores deposit time [E7](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.1.md)
- Single-second lump emission frontrun [E8](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.6.md)

## Impact and severity
Drains of other users' deposits [E1](https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-18.md), capture of nearly all future distributions [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-6.md), theft of queued rewards [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md), distributor drain [E4](https://bugbountylibrary.com/r/dhl%3A20260517-seatoken.md), inflated claims from hook ordering [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-10.md), retroactively inflated claims [E6](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.1.1.md), fee siphoning from long-term LPs [E7](https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.1.md), frontrun of one-shot emissions [E8](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.6.md). Severity rises when the manipulated value is large relative to the pool and the claim is repeatable across fresh addresses or atomic in one transaction.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-18.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-6.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260517-seatoken.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-10.md
- E6: https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.1.1.md
- E7: https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.1.md
- E8: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.6.md