# Accumulated rewards in FSTO can be stolen by the agent's owner

Bug Deep Dive #27 · 23 December 2025

Bug Deep Dives · [The Contest Academy](https://0xsimao.com/the-contest-academy) · 0xSimao

---

| Title | Accumulated rewards in FSTO can be stolen by the agent's owner |
| Reward | $33790, Unique |
| Contest | FAssets - 19 August 2025 on Code4rena |
| Author | pashap9990 |
| Context | Wrong Tracking |

Rewards earned from FTSO by delegating voting power to signal providers can be stolen by the agent's owner, because of a mismatch between the reward token's address and WNAT's address in the `CollateralPool` contract. CPT holders forfeit the rewards.

```solidity
function claimDelegationRewards(
    IRewardManager _rewardManager,
    uint24 _lastRewardEpoch,
    IRewardManager.RewardClaimWithProof[] calldata _proofs
)
    external
    onlyAgent
    nonReentrant
    returns (uint256)
{
@>>   uint256 balanceBefore = wNat.balanceOf(address(this));
    _rewardManager.claim(address(this), payable(address(this)), _lastRewardEpoch, true, _proofs);
@>>   uint256 balanceAfter = wNat.balanceOf(address(this));
    uint256 claimed = balanceAfter - balanceBefore;
    totalCollateral += claimed;
    assetManager.updateCollateral(agentVault, wNat);
    emit CPClaimedReward(claimed, 1);
    return claimed;
}
```

- Users contribute their WNATs to the agent’s pool.
- The owner’s agent delegates voting power to signal providers.
- The WNAT address is modified by the asset updater in the Flare Time Series Oracle (FTSO).
- `AssetManagerController::updateContracts` can be called by anyone, as it has no access control. The agent's owner spots the opportunity and calls `CollateralPool::claimDelegationRewards`, which transfers the new WNAT into the agent's pool. `totalCollateral` is unchanged, because the received token no longer matches the pool's collateral token.
- The agent's owner then calls `CollateralPool::upgradeWNatContract`, which merely swaps the old WNAT for the new version.
- Finally, the agent's owner sweeps the collected new WNAT as a reward, after announcing destruction.

**Alpha:** ask what breaks when an admin function is called. Here, changing the WNAT address is what opens the door for the agent owner.

**Conclusion**

This finding would earn you **\$33790**. Always work out the impact of the admin functions.

[**Full Report**](https://code4rena.com/reports/2025-08-flare-fasset#m-03-accumulated-rewards-in-fsto-can-be-stolen-by-the-agents-owner)\
[**Codebase**](https://github.com/code-423n4/2025-08-flare/tree/main)

---

Newer: [The collateral that liquidators receive is valued below their initial expectations as a result of the price fall](https://0xsimao.com/the-contest-academy/bug-deep-dive-28) · Older: [Vault owner is incentivized to not switch invalid collateral token during liquidation](https://0xsimao.com/the-contest-academy/bug-deep-dive-26)