F-2025-0009·missing-bound-check

Unclaimable Dust May Accumulate and Lock Tokens

Acknowledgedliquid-stakinglststaking-poolsgithub.com/matchain/contracts
TL;DR

claimDust() requires totalEmitted + dust <= MAX_SUPPLY. If rewardDistribution accumulates dust faster than the owner reclaims it, this require permanently reverts and locks the accumulated dust.

Severity
MEDIUM
Impact
LOW
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

In the claimDust() function, the following condition is enforced:

solidity
require(totalEmitted + dust <= MAX_SUPPLY, "Max supply exceeded");

If this function is not called periodically, the dust variable may grow over time due to repeated accumulation within the rewardDistribution() function:

solidity
if (dustAmount > 0) {
dust += dustAmount;
}

This dust is the leftover remainder from reward allocation rounding, and while it is stored for later minting, it is only claimable by the owner via claimDust(). If dust grows large enough such that totalEmitted + dust > MAX_SUPPLY, the required condition in claimDust() will revert permanently, locking the accumulated dust and preventing its recovery, effectively causing a denial-of-service on this portion of the supply.

This creates a scenario where tokens that should have been minted and distributed remain forever unclaimable due to an avoidable overflow condition.

03Section · Impact

Impact

Tokens worth up to the difference between accumulated dust and the MAX_SUPPLY headroom become permanently unclaimable. The MAT token economy loses a portion of its intended emission.

04Section · Recommendation

Recommendation

There are several options:

  1. Ensure dust is never allowed to grow beyond MAX_SUPPLY - totalEmitted during accumulation.
  2. Automatic Dust Distribution: Instead of relying on manual claimDust(), integrate dust distribution directly into rewardDistribution() by redistributing leftovers in the next cycle. This avoids centralization of dust collection and prevents accumulation beyond reclaimable limits.
F-2025-0009

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx