# SherlockClaimManager: Incorrect amounts needed and paid for escalated claims

SherlockClaimManager escalation overcharges protocol agents: UMA burns half the bond plus final fee, contradicting docs that promise full stake return.

- Payout: Audit contest
- Severity: medium
- Program: Sherlock
- Found by: GreyArt
- Disclosed: 2022-05-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sherlock-findings/issues/230
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sherlock%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SherlockClaimManager escalation flow via UMA SkinnyOptimisticOracle
**Root cause:** escalate() passes BOND as UMA's request bond, so UMA burns floor(BOND/2) plus final fee on dispute settlement; docs claimed the agent recovers stake in full.
**Steps:**
1. Set BOND=9600, umaFee=400 in SherlockClaimManager.
2. Call `escalate()`: `requestAndProposePriceFor()` transfers `BOND + umaFee` (10000) to UMA.
3. Call `disputePriceFor()`: transfers another `BOND + umaFee` (10000).
4. On settlement UMA burns `floor(BOND/2) + finalFee` = 4800+400 = 5200 via `_computeBurnedBond` and `payOracleFeesErc20`.
5. Winner payout = `bond + (bond - burnedBond) + finalFee + reward` = 14800, not the full 20000 expected.
**How found:** Cross-compared Sherlock's claims documentation (full stake returned) against UMA SkinnyOptimisticOracle source, spotting the burnedBond computation and final fee deduction on settlement.
**Insight:** When a protocol wraps an external oracle (UMA), read the oracle's settlement/burn logic rather than trusting the integrator's docs; bond-vs-reward parameter reuse silently incurs the oracle's burn fee.