# Per-address reward eligibility without ledger

Reward or tier eligibility keyed only to caller address or live balance, with no per-address claim record

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2026-05-25. Updated 2026-10-23._

## How it works
A reward, fee, or tier gate decides eligibility from something that resets or is trivially re-created: the caller's current token balance, or simply the caller's address. There is no persistent per-address record of what was already claimed. The broken assumption is that "this address qualifies" means "this participant has not been paid." When a fresh address always passes the gate, one actor can present many addresses and collect the reward many times.

## Where it shows up
- Eligibility checks reading only `balanceOf(msg.sender)` or a live balance threshold, with no mapping of claimed amounts or cooldowns [E1](https://bugbountylibrary.com/r/dhl%3A20260525-wusd.md)
- Fee or reward distribution functions callable repeatedly with no claim tracking or frequency limit [E2](https://bugbountylibrary.com/r/dhl%3A20240102-mic.md)
- Multi-tier referral payouts where the buyer can occupy both referrer tiers [E3](https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md)
- Per-address limits keyed on `msg.sender` only, bypassable by deploying fresh contracts [E2](https://bugbountylibrary.com/r/dhl%3A20240102-mic.md)[E3](https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md)
- The same action both mints the reward and advances the vesting or distribution state [E1](https://bugbountylibrary.com/r/dhl%3A20260525-wusd.md)

## How to review
Identify every gate that grants value (mint, fee share, tier, referral). For each, find the persistent state that records prior grants per participant. The invariant: total value paid to a participant over time must be bounded by a ledger entry that survives address changes and cannot be reset by moving tokens or deploying a new contract. Check that:
- A per-address (or per-identity) claim record exists and is updated before payout [E1](https://bugbountylibrary.com/r/dhl%3A20260525-wusd.md)[E2](https://bugbountylibrary.com/r/dhl%3A20240102-mic.md)
- Reward distribution cannot be re-triggered by transferring the qualifying token to a new address [E2](https://bugbountylibrary.com/r/dhl%3A20240102-mic.md)
- Referral logic rejects the case where buyer and referrer are the same controller [E3](https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md)
- Limits are not solely `msg.sender`-keyed where fresh contracts are cheap [E3](https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md)

## Variants seen
- Balance-gated mint: fresh address with zero balance qualifies for a fresh reward per wrap [E1](https://bugbountylibrary.com/r/dhl%3A20260525-wusd.md)
- Repeated fee claim: LP tokens moved to new addresses to re-claim distributed fees [E2](https://bugbountylibrary.com/r/dhl%3A20240102-mic.md)
- Self-referral farming: buyer controls both referral tiers, limits bypassed via proxy contracts [E3](https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md)

## Impact and severity
Drains of thin liquidity pools and vaults: ~$200K [E1](https://bugbountylibrary.com/r/dhl%3A20260525-wusd.md), ~$500K [E2](https://bugbountylibrary.com/r/dhl%3A20240102-mic.md), ~60,950 USDT [E3](https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md). Severity is high where reward pools sit behind thin liquidity or where the deployer also controls pool liquidity, amplifying slippage and exit losses [E1](https://bugbountylibrary.com/r/dhl%3A20260525-wusd.md)[E3](https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260525-wusd.md
- E2: https://bugbountylibrary.com/r/dhl%3A20240102-mic.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260414-mona-lisavault.md