# StakingPool is missing rewards distribution end logic Low/Info · 0xSimao · AI revenue sharing · 28th November 2025 Finding L-1 of the Spirit Protocol security review. - Report: /reports/spirit-protocol - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-11-28-spirit-protocol.pdf --- **Description:** The [StakingPool](https://github.com/0xPilou/spirit-contracts/blob/main/src/core/StakingPool.sol#L25) has 1 unit so no flow is lost, but there is no way for the owner to get this Spirit back. It will flow in the next distribution, but this issue refers specifically to when there is no next distribution. Additionally, there is no way to stop the flow, so it will be liquidated and some Spirit will be lost. **Impact:** Lost Spirit. **Recommended Mitigation:** Add a way to stop the flow and transfer the remaining Spirit. **0xSimao:** Fixed in PR [#4](https://github.com/0xPilou/spirit-contracts/pull/4). --- Related findings: - [feesAccrued or staker principal may be sent as rewards if rewardRate and emissionEnd are not properly calculated](https://0xsimao.com/findings/metazero-ii-fees-rewards-reward-properly): MetaZero Staking - [Increasing emissionEnd after the previous emissionEnd ended will yield full rewards according to newEmissionEnd - prevEmissionEnd](https://0xsimao.com/findings/metazero-ii-yield-full-rewards-according): MetaZero Staking - [Wrong reward distribution between early and late depositors because of the late `syncRewards()` call in the cycle, `syncReward()` logic should be executed in each withdraw or deposits (without reverting)](https://0xsimao.com/findings/gogopool-reward-rewards-withdraw-deposits): GoGoPool - [`Voter::finalize()` incorrect rewards distribution due to transfering WETH before calling `distributor::setTokensPerInterval()`](https://0xsimao.com/findings/bmx-voter-rewards-transfering-weth): BMX