# ConvexStakingWrapper.enterShelter() May Erroneously Overwrite amountInShelter Leading To Locked Tokens

Concur's enterShelter overwrites amountInShelter instead of accumulating, corrupting shelter share math and locking LP tokens after grace period.

- Payout: Audit contest
- Severity: medium
- Program: Concur Finance
- Found by: leastwood
- Disclosed: 2022-05-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-concur-findings/issues/109
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ConvexStakingWrapper.sol shelter mechanism (Solidity contract)
**Root cause:** enterShelter assigns `amountInShelter[lpToken] = amount` on each call rather than accumulating, so a second call (possibly with zero balance) overwrites the recorded shelter total that totalShare/withdraw math depends on.
**Steps:**
1. Owner calls `enterShelter([pid])`; wrapper withdraws full pool balance and sets `amountInShelter[lpToken] = amount`, transfers to shelter, activates.
2. Call `enterShelter([pid])` again on same LP token; pool balance now zero, so `amountInShelter[lpToken]` is overwritten with 0 (or a smaller value).
3. `totalShare(lpToken)` now returns the wrong total; `Shelter.withdraw` share math is corrupted.
4. After grace period, users cannot withdraw correct shares; tokens locked in shelter.
**How found:** Code review of shelter accounting: noticed amountInShelter is assigned rather than incremented, and totalShare reads it directly, implying repeated enterShelter calls corrupt withdrawal math.
**Exploitation:** Requires owner (distracted or malicious) to call enterShelter twice on the same LP token; no external attacker path. Result is corrupted shelter accounting and locked LP tokens.
**Insight:** When a contract caches a total used as denominator for share math, check every write path for overwrite vs accumulate; re-invocable admin functions that reset totals are a classic locked-funds vector.