# If The Staking Token Exists In Both StakingRewards.sol And ConvexStakingWrapper.sol Then It Will Be Possible To Continue Claiming Concur Rewards After The Shelter Has Been Activated

Shelter mechanism doesn't wipe MasterChef balances, so withdrawn staking tokens redeposited into StakingRewards.sol earn double Concur rewards.

- Payout: Audit contest
- Severity: medium
- Program: Concur Finance
- Found by: leastwood
- Disclosed: 2022-05-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-concur-findings/issues/117
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AM-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** StakingRewards.sol / ConvexStakingWrapper.sol / MasterChef.sol staking accounting
**Root cause:** Shelter.sol withdraws staking tokens after grace period but does not wipe the user's deposited balance in MasterChef.sol, so the same tokens remain credited for ConvexStakingWrapper rewards while also being redeposited into StakingRewards.sol.
**Steps:**
1. Deposit staking token into ConvexStakingWrapper.sol, earning Concur rewards via MasterChef allocPoint.
2. Owner activates Shelter.sol for an emergency; after grace period withdraw staking tokens.
3. Note MasterChef still records the original ConvexStakingWrapper deposit balance (not wiped).
4. Deposit the same staking tokens into StakingRewards.sol.
5. Claim Concur rewards from both StakingRewards.sol and the un-wiped ConvexStakingWrapper balance, receiving roughly double rewards.
**How found:** Code review of the shelter flow: noticed Shelter withdraws tokens without clearing MasterChef accounting, and that the same token is accepted by both StakingRewards.sol and ConvexStakingWrapper.sol, enabling double counting.
**Exploitation:** User stakes, waits for shelter activation, withdraws tokens post-grace-period, redeposits into StakingRewards.sol, and claims rewards on both the new StakingRewards balance and the stale ConvexStakingWrapper balance in MasterChef, extracting extra Concur rewards.
**Insight:** When a protocol adds an emergency 'shelter'/pause path, check whether it only moves tokens but leaves reward-accounting state (MasterChef balances) intact; any second contract accepting the same token lets stale balances be double-claimed.