# Users at UNSTAKE_PERIOD can assist other users in unstaking tokens.

Weighted-average cooldown merge lets a user at the edge of UNSTAKE_PERIOD absorb freshly staked tokens and unstake roughly half of them immediately.

- Payout: Audit contest
- Severity: medium
- Program: Paladin
- Found by: cccz
- Disclosed: 2022-05-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-paladin-findings/issues/7
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-paladin%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** HolyPaladinToken staking cooldown logic (_getNewReceiverCooldown)
**Root cause:** When tokens transfer to a receiver with an earlier cooldown, the new cooldown is a balance-weighted average of sender and receiver cooldowns, so a receiver near the end of UNSTAKE_PERIOD pulls freshly staked tokens' cooldown forward.
**Steps:**
1. Day 0: user A stakes 200 tokens and calls cooldown; A's cooldown = Day 0.
2. Day 15: user B stakes 100 tokens (cooldown Day 15) and wants out early.
3. A deploys a contract; B transfers 100 tokens to A.
4. In `_getNewReceiverCooldown`, senderCooldown=Day15, receiverCooldown=Day0, receiverBalance=200, amount=100 -> new cooldown = (100*Day15 + 200*Day0)/300 = Day 5.
5. A is still within UNSTAKE_PERIOD, so A unstakes 100 tokens and sends them to B.
**How found:** Code reading of `_getNewReceiverCooldown` weighted-average formula, then reasoning about a colluding receiver whose cooldown is older than the sender's to see how much lock time is erased.
**Exploitation:** A colluding receiver positioned at the edge of UNSTAKE_PERIOD accepts a transfer of freshly staked tokens; the weighted-average cooldown formula drags the new tokens' effective cooldown back toward A's old cooldown, letting A unstake and return the tokens to B without B waiting the full cooldown.
**Escalation:** With balance X at the UNSTAKE_PERIOD edge, A can assist unstaking up to ~X/2 tokens; ratio scales as UNSTAKE_PERIOD/COOLDOWN_PERIOD = UNSTAKE_AMOUNT/USER_BALANCE.
**Insight:** In staking/vesting contracts, weighted-average cooldown or lock merging is exploitable: a receiver with an older cooldown can launder a sender's fresh lock. Check any formula that blends sender and receiver timestamps for collusion between accounts.