Staking rewards divide before multiplying (reward / totalSupply * stake) or omit a scaling factor (1e18), so small stakers accrue zero rewards and dust accumulates unclaimed in the contract.
// rewardPerToken = reward / totalSupply; // integer -> 0 when reward < supply // every small staker earns 0; rewards pile up and are never distributed.
rewardPerToken += reward * 1e18 / totalSupply; // scale up first earned = stake * (rewardPerToken - paid[user]) / 1e18; // scale down last
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0219 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.