# ConvexStakingWrapper.exitShelter() Will Lock LP Tokens, Preventing Users From Withdrawing

ConvexStakingWrapper.exitShelter returns LP tokens to the wrapper without restaking, so withdraw() reverts and users' LP tokens are locked or swiped.

- Payout: Audit contest
- Severity: high
- Program: Concur Finance
- Found by: leastwood
- Disclosed: 2022-05-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-concur-findings/issues/144
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ConvexStakingWrapper.sol
**Root cause:** exitShelter deactivates the shelter and returns LP tokens to the wrapper contract but never re-deposits them into the Convex reward pool, so the wrapper's staked balance no longer backs user deposits.
**Steps:**
1. Owner calls enterShelter: LP tokens withdrawn from pool, sent to shelter, shelter activated.
2. Owner calls exitShelter(_pids): sets amountInShelter[lpToken]=0 and shelter.deactivate(lpToken), returning LP tokens to ConvexStakingWrapper without restaking.
3. User calls withdraw(_pid,_amount): passes epoch checks, then `IRewardStaking(convexPool[_pid]).withdrawAndUnwrap(_amount,false)` reverts due to insufficient staked balance.
4. LP tokens remain idle in wrapper; later depositors' staked tokens can be claimed by locked users, or locked users lose funds.
**How found:** Manual code review of the shelter enter/exit flow versus the withdraw path; noticed exitShelter only deactivates and returns tokens without restaking, then traced withdraw's withdrawAndUnwrap call to confirm it would revert.
**Exploitation:** Requires owner to invoke enterShelter then exitShelter; afterwards any user withdraw reverts because withdrawAndUnwrap has no staked balance, leaving LP tokens stranded in the wrapper where they can be misappropriated by other depositors.
**Insight:** When auditing emergency/shelter mechanisms, verify the exit path fully restores the pre-shelter state (re-staking, accounting resets); a deactivate that only moves tokens back leaves internal staked-balance accounting inconsistent with withdraw logic.