# Wrong implementation of CreditLimitByMedian.sol#getLockedAmount() makes it unable to unlock lockedAmount in CreditLimitByMedian model

CreditLimitByMedian.getLockedAmount subtracts 1 instead of the unlock amount, so locked stake can never be released in the median credit-limit model.

- Payout: Audit contest
- Severity: high
- Program: Union Finance
- Found by: WatchPug
- Disclosed: 2021-12-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-union-findings/issues/80
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-union%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** CreditLimitByMedian.sol getLockedAmount / UserManager.updateLockedData
**Root cause:** In the isIncrease=false branch, newLockedAmount is set to array[i].lockedAmount - 1 instead of subtracting the requested unlock amount, so locked amount decreases by only 1 wei per call.
**Steps:**
1. Read CreditLimitByMedian.getLockedAmount loop over LockedInfo[] for the staker.
2. Note the else branch computes `newLockedAmount = array[i].lockedAmount - 1` regardless of `amount`.
3. Call UserManager.updateLockedData with isIncrease=false and any amount; locked amount only drops by 1.
4. Observe lockedAmount can never be fully unlocked; fix is `array[i].lockedAmount - amount`.
**How found:** Code review of the unlock branch of getLockedAmount, noticing the subtraction uses literal 1 rather than the amount parameter.
**Insight:** In accounting loops with increase/decrease branches, verify the decrease branch actually uses the passed amount; a hardcoded decrement silently bricks withdrawals.