# BondVault.sol: Possibly unwithdrawable bondedLP funds in claimForMember() + claimRate never zeros after full withdrawals

In BondVault.claimForMember, bondedLP is decremented before the final-claim check, so claiming exactly half zeroes claimRate and permanently locks the other half.

- Payout: Audit contest
- Severity: medium
- Program: Spartan Protocol
- Found by: hickuphh3
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/42
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AM-12
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BondVault.sol claimForMember()/claimAllForMember() bonding logic
**Root cause:** bondedLP[member] is decremented by _claimable before the equality check against the remaining balance, so the check compares the post-deduction value instead of the pre-deduction value.
**Steps:**
1. User has bondedLP[member] = 2 * _claimable for an asset.
2. Call dao.claimForMember() (or attacker calls dao.claimAllForMember()) such that _claimable equals exactly half the remaining bondedLP.
3. L110 executes `bondedLP[member] -= _claimable`, leaving bondedLP = _claimable.
4. L111 `if(_claimable == bondedLP[member])` is now true, so L112 sets claimRate[member] = 0.
5. calcBondedLP() returns 0 for the member; remaining half of bondedLP is permanently unwithdrawable.
**How found:** Code reading of claimForMember L110-113: noticed the deduction happens before the equality condition, making the final-claim check compare against the already-reduced balance.
**Exploitation:** A user or a third party calling claimAllForMember can trigger a claim sized to exactly half the remaining bondedLP, zeroing claimRate and stranding the other half; no direct theft, funds locked in contract.
**Insight:** When a state variable is both mutated and used in a terminal-condition check, verify ordering: decrement-before-compare turns an equality check into a half-balance trigger and can zero out rate/accounting state prematurely.