# Dust notify dilutes reward rate

Permissionless notify with dust resets period or dilutes rate; check minimum thresholds and period extension logic

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2023-06-23. Updated 2026-10-23._

## How it works
A reward-distribution function is callable by anyone and recomputes the emission rate as `(newAmount + leftover) / duration` while also resetting the period end to `now + duration`. A tiny deposit therefore restarts the full window and spreads the same total over a longer time, lowering the rate stakers actually receive. The broken assumption is that only meaningful amounts reach the notify path, or that a caller has an incentive to add real rewards.

## Where it shows up
- Permissionless `notifyRewardAmount` / `_notifyReward` / `distributeOther` callable during an active period.
- `periodFinish` set to `now + DURATION` instead of extending from remaining time.
- `rewardRate` recomputed from `(new + leftover)/duration` with no minimum-amount check.
- Sibling functions (e.g. `queueNewRewards`) that do enforce a threshold, while the notify path does not.

## How to review
The invariant: adding a negligible amount must not reduce the per-second rate or extend the period for existing stakers. Check that notify either (a) rejects amounts below a threshold, (b) extends `periodFinish` from the remaining time rather than resetting, or (c) leaves `rewardRate` unchanged when the added amount is dust. Confirm the caller of any rate-affecting function is trusted or that the amount is bounded. As a positive check, compare against sibling functions that already guard this: `queueNewRewards` enforces a 120% threshold before accepting an addition [E6](https://bugbountylibrary.com/r/c4%3A2022-05-aura%3AM-06.md). Also inspect the acceptance condition when a period is active: `notifyRewardAmount` accepts any amount greater than the remaining undistributed rewards, so dust above that leftover still resets the window [E5](https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-11.md).

## Variants seen
- Dust notify extends active period and dilutes rate [E5](https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-11.md).
- 1 wei deposit plus `distributeOther` resets 7-day period, no threshold unlike sibling [E6](https://bugbountylibrary.com/r/c4%3A2022-05-aura%3AM-06.md).

## Impact and severity
Rewards delayed, diluted, or never fully distributed; griefing at near-zero cost. Worse when the period is long and the threshold absent, and when the same notify path is reused across many gauges or lockers [E5](https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-11.md)[E6](https://bugbountylibrary.com/r/c4%3A2022-05-aura%3AM-06.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-8.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-52.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-02.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-04.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AM-11.md
- E6: https://bugbountylibrary.com/r/c4%3A2022-05-aura%3AM-06.md