# unstake should update exchange rates first

Covalent staking unstake() computes shares to burn with stale exchange rate before updating it, burning excess shares and forfeiting accrued rewards.

- Payout: Audit contest
- Severity: high
- Program: Covalent
- Found by: cmichel
- Disclosed: 2021-11-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-10-covalent-findings/issues/57
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-covalent%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Solidity staking contract unstake() function
**Root cause:** unstake() calls tokensToShares(amount, v.exchangeRate) using the pre-update exchange rate, then calls updateGlobalExchangeRate()/updateValidator(v) afterward, so shares removed are computed against an outdated rate.
**Steps:**
1. Staker has 1000 shares, v.exchangeRate=1.0, single staker.
2. Epochs pass; 1000 tokens accrue as tokensGivenToValidator.
3. User calls `unstake(1000)`; validatorSharesRemove = tokensToShares(1000, 1.0) = 1000 computed with old rate.
4. Afterward updateGlobalExchangeRate() sets v.exchangeRate = 1.0 + 1000/1000 = 2.0.
5. s.shares -= 1000 -> 0; s.staked -= 1000 -> 0; user receives 1000 tokens.
6. redeemAllRewards() returns 0 rewards; user lost the 1000 in accrued rewards.
**How found:** Code reading of unstake() ordering: noticed tokensToShares uses v.exchangeRate before updateGlobalExchangeRate()/updateValidator() are invoked, hypothesized stale-rate share burn, confirmed with a single-staker numeric example.
**Exploitation:** User unstaking before rate update forfeits accrued rewards because all shares are burned at the old (lower) rate; calling redeemAllRewards first would have yielded 2000 tokens.
**Insight:** In staking/reward contracts, check ordering of share-price/exchange-rate updates versus share math: any tokensToShares/shares computation before the rate refresh uses stale accounting and can over-burn shares.