# debtWriteOff updates totalFrozen immaturely, thereby losing staker rewards

debtWriteOff updates totalFrozen before withdrawing unionToken rewards, so a staker calling it loses accrued rewards when totalFrozen equals totalStaked.

- Payout: Audit contest
- Severity: medium
- Program: Union Finance
- Found by: kenzo
- Disclosed: 2021-12-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-union-findings/issues/28
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-union%3AM-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** UserManager/Comptroller reward accounting (Solidity)
**Root cause:** debtWriteOff calls updateTotalFrozen before comptroller.withdrawRewards; updateTotalFrozen can set totalFrozen == totalStaked, making calculateRewardsByBlocks compute totalStaked - totalFrozen = 0 and pay zero rewards.
**Steps:**
1. Staker has staked unionToken and accrued rewards; borrower is overdue.
2. Staker calls `debtWriteOff(borrower)` on UserManager.
3. Inside, `updateTotalFrozen` runs first, setting `totalFrozen` up to `totalStaked`.
4. Then `comptroller.withdrawRewards` calls `calculateRewardsByBlocks`, computing `totalStaked() - totalFrozen` = 0.
5. `calculateRewards` receives 0 as third param and pays no rewards.
6. Compare: calling `withdrawRewards` before `debtWriteOff` yields rewards.
**How found:** Code reading of debtWriteOff ordering versus stake/unstake/withdrawRewards; noticed inconsistency in when updateTotalFrozen is invoked, then traced into Comptroller reward math and confirmed with a hardhat script comparing debtWriteOff vs withdrawRewards balances.
**Insight:** When auditing reward/frozen accounting, check the ordering of state mutations relative to reward settlement calls; any function that updates a denominator/numerator (totalFrozen) before paying out can zero out rewards. Compare ordering across all entry points that touch the same accounting variables.