VeChain Disclosed Report

Summary

The system incorrectly determines the claimable reward periods for a delegated NFT after the delegator has requested to exit. This occurs because the ended-delegation branch uses a strict comparison:

endPeriod > nextClaimablePeriod

instead of the correct:

endPeriod >= nextClaimablePeriod

When endPeriod == nextClaimablePeriod, the code fails to recognize that the delegation has already ended and instead treats it as still active. As a result, once new validator periods are completed, the delegator can call claimRewards() to claim rewards for periods after their delegation has already ended, even though their stake is no longer contributing and the validator is no longer using their VET.

This allows delegators to drain rewards for periods they did not stake for, extracting unearned VTHO and destabilizing the reward pool.

Vulnerability Details

Relevant code paths:

The core logic is inside _claimableDelegationPeriods:

if (
    endPeriod != type(uint32).max &&
    endPeriod < currentValidatorPeriod &&
 @>>   endPeriod > nextClaimablePeriod
) {
    return (nextClaimablePeriod, endPeriod);
}

Because the condition uses a strict endPeriod > nextClaimablePeriod, the ended-delegation branch does not trigger when the staker has claimed up to exactly endPeriod - 1.

The system incorrectly assumes the delegation is still active and falls through to this logic:

if (nextClaimablePeriod < currentValidatorPeriod) {
    return (nextClaimablePeriod, completedPeriods);
}

This returns:

(firstClaimable = nextClaimablePeriod,
 lastClaimable = completedPeriods)

Meaning the delegator can now claim rewards for all periods between endPeriod and the current completed period, even though the validator is no longer using their stake.

Impact

Delegators can claim VTHO rewards for future validator periods after their delegation has ended. Since the validator has already processed the exit and the user’s stake is no longer participating in validation.

Recommendation

Fix the boundary condition in the ended-delegation branch to be more inclusive properly:

endPeriod >= nextClaimablePeriod

This is a outline of the steps to reproduce the bug, it is a strictly checking equality that led to the bugs. Validation Steps:

1. Delegate VET to a validator to create a delegation NFT (make it 2 delegators)

2. Request delegation exit using requestDelegationExit().

3. Track the delegation’s endPeriod and note the nextClaimablePeriod.

4. Wait until new validator periods are completed after the exit.

5. Call claimRewards() — observe that the system allows claiming rewards for periods after the delegation has ended.

6. Confirm that rewards are incorrectly credited, even though the user’s stake is no longer active with the validator.

7. Note that if we want to exit for the other user it always reverts