# Deleting nft Info can cause users' nft.unpaidRewards to be permanently erased

LiquidityFarming.withdraw deletes nftInfo after _sendRewardsForNft, erasing any unpaidRewards recorded when the contract lacked balance to pay them.

- Payout: Audit contest
- Severity: high
- Program: Biconomy
- Found by: WatchPug
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-biconomy-findings/issues/135
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity vuln:accounting-error vuln:business-logic

**Target:** LiquidityFarming.sol staking withdraw/reward contract
**Root cause:** withdraw() calls _sendRewardsForNft which may set nft.unpaidRewards = pending - balance when the contract balance is insufficient, then unconditionally deletes nftInfo[_nftId], wiping the recorded debt.
**Steps:**
1. Stake an NFT via LiquidityFarming so nftInfo[_nftId] exists with rewardDebt.
2. Ensure contract reward balance is less than pending rewards (e.g. rewards not yet funded).
3. Call `withdraw(_nftId, _to)`; _sendRewardsForNft sets `nft.unpaidRewards = pending - balance` and pays only balance.
4. withdraw then executes `delete nftInfo[_nftId]`, erasing unpaidRewards permanently.
5. User can never claim the remaining rewards; no code path restores them.
**How found:** Code review of withdraw() ordering: noticed _sendRewardsForNft can persist unpaidRewards, but the subsequent delete nftInfo[_nftId] removes the same struct field, making the debt unrecoverable.
**Exploitation:** Any staker withdrawing while the contract's reward balance is below accrued pending rewards triggers the shortfall branch; the unpaid remainder is recorded then immediately deleted, permanently forfeiting the user's earned rewards.
**Insight:** When a function persists a debt/credit field for later claiming, check whether the caller deletes or resets that struct afterward; ordering of settle-then-delete is a recurring reward-loss pattern in staking contracts.