# tokenBalanceOfAddress of nftOwner becomes permanently incorrect after arbRestake

arbRestake redeems arbRewardShares reducing NFT stakeShares but never decrements owner's addressShares, so tokenBalanceOfAddress permanently over-reports the owner's balance.

- Payout: Audit contest
- Severity: medium
- Program: Sherlock
- Found by: hyh
- Disclosed: 2022-05-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sherlock-findings/issues/109
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sherlock%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** Solidity staking contract (Sherlock.sol) share accounting
**Root cause:** arbRestake calls _redeemShares for arbRewardShares which reduces stakeShares of the NFT, but addressShares[nftOwner] is only updated on mint/burn/transfer, so the two accounting mappings diverge.
**Steps:**
1. Owner stakes NFT; addressShares[owner] and stakeShares[NFT] both set.
2. arbRestake executes and calls _redeemShares(arbRewardShares), reducing stakeShares[NFT] (Sherlock.sol#L491).
3. addressShares[owner] is not decremented.
4. Call tokenBalanceOfAddress(owner): reports pre-arbitrage inflated balance.
5. Transfer NFT: _beforeTokenTransfer subtracts new reduced stakeShares from addressShares, leaving the arbitrage-removed shares permanently stuck in addressShares.
6. Repeat arbRestakes to accumulate the discrepancy.
**How found:** Code reading of arbRestake/_redeemShares vs _beforeTokenTransfer, noticing addressShares is only mutated on mint/burn/transfer while stakeShares is reduced by partial redeem.
**Escalation:** Discrepancy accumulates across repeated arbRestakes and persists across NFT transfers, permanently inflating reported balance.
**Insight:** When a contract keeps two parallel accounting mappings (per-user aggregate vs per-token), audit every path that mutates one and check the other is updated in lockstep; partial-redeem paths are a classic divergence source.