# Newly added rewards will not be immediately collected Low/Info · 0xSimao · Leveraged yield farming · 12th May 2025 Finding L-2 of the Yieldoor Gauges security review. - Protocol: https://app.yieldoor.com/ - Report: /reports/yieldoor-i - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-05-12-yieldoor-i.pdf --- **Description:** Reward tokens are set on Yieldoor [manually](https://github.com/spacegliderrrr/yieldoor/blob/master/src/instances/ShadowStrategyGauge.sol#L738), which means there is a window where rewards may be added in the Gauge, but they weren't yet added on Yieldoor. **Recommended Mitigation:** Rewards are never lost as they can be claimed next week in the following `ShadowStrategyGauge::collectGaugeRewards()` call, but it can still go a week without claiming them. It may be managed by always verifying the current rewards before calling `ShadowStrategyGauge::collectGaugeRewards()`, but this is not 100% flawless. --- Related findings: - [Immediately start getting rewards belonging to others after staking](https://0xsimao.com/findings/tokemak-rewards-belonging-others-staking): Tokemak - [Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull](https://0xsimao.com/findings/tokemak-rewards-info-pulled-pull): Tokemak