# Cooldown and redeem windows can be rendered useless

sNOTE cooldown/redeem window is not bound to staked amount, so an account can start cooldown, wait once, then deposit and redeem freely, defeating the lock.

- Payout: Audit contest
- Severity: high
- Program: Notional
- Found by: ShippooorDAO
- Disclosed: 2022-03-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-notional-findings/issues/68
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** sNOTE staking/cooldown contract
**Root cause:** startCooldown is callable externally and the cooldown/redeem window is not bound to the amount minted at cooldown start, so once a redeem window opens it applies to any later deposits.
**Steps:**
1. Call `sNOTE.startCooldown()` on an account with no prior stake.
2. Wait out the cooldown duration until the redeem window opens.
3. Deposit sNOTE and redeem within the now-open window; repeat deposits/redeems freely.
4. Optionally transfer between multiple accounts to hop redeem windows.
**How found:** Reading the cooldown/redeem logic and noticing startCooldown is externally callable and the window is not tied to the minted amount, so a single wait unlocks future deposits.
**Exploitation:** Attacker opens a redeem window once with a minimal/no stake, then deposits and withdraws arbitrarily during the window, nullifying the cooldown lock; could enable flash-loan-funded voting power attacks if voting is unmonitored.
**Escalation:** Multiple accounts hop between redeem windows to keep a window perpetually available; flash loans could amplify voting power.
**Insight:** When a timelock/cooldown gates withdrawals, check whether the unlock is bound to the specific stake amount and timestamp; an externally callable startCooldown that opens a global window lets users deposit after unlocking.