# InterestRouterV2::triggerDistribution() may be vulnerable to arbitrage stratregies due to being permissionless Low/Info · 0xSimao · CDP stablecoin · 14th March 2025 Finding I-6 of the Felix Price Feeds security review. - Protocol: https://www.usefelix.xyz/ - Report: /reports/felix - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-03-14-felix.pdf --- **Description:** `InterestRouterV2::triggerDistribution()` is permissionless and may add significant rewards to the external contracts. In this process, arbitragers could employ arbitrage strategies, such as depositing, calling `InterestRouterV2::triggerDistribution()` and then withdrawing, stealing most of the rewards. **Recommended Mitigation:** While curve gauges are not vulnerable to this as rewards are distributed over 1 week, it is something to keep in mind, even more so because other strategies could be used in the future that are vulnerable. **0xSimao:** Fixed in [#9f2906b](https://github.com/felixprotocol/felix-contracts/commit/9f2906b58f9ff7b1c022bce59a1edaca02e46513).