# Increasing the Lock Amount on an Expired Lock Will Cause Users to Miss Out on Rewards

Increasing the amount on an expired lock creates a new lock carrying the stale bonus ratio, so the user earns no rewards until they extend duration.

- Payout: Audit contest
- Severity: medium
- Program: Paladin
- Found by: leastwood
- Disclosed: 2022-05-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-paladin-findings/issues/95
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-paladin%3AM-14
- Tags: domain:web3 kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** HolyPaladinToken.sol lock management (increaseLockAmount / lock creation)
**Root cause:** When increasing amount on an expired lock, a new lock is created but the `action != LockAction.INCREASE_AMOUNT` branch is skipped, so `userCurrentBonusRatio` retains the stale value from the previous lock instead of being recomputed.
**Steps:**
1. Create a lock with some amount and duration; let it expire.
2. Call the increase-amount path with a non-zero amount on the expired lock.
3. Observe a new lock is created with the old duration but `userCurrentBonusRatio` is not recalculated (stale value).
4. Check reward accrual: user receives no rewards for the active lock until duration is increased.
**How found:** Code reading of the lock increase logic: noticed the `action != LockAction.INCREASE_AMOUNT` guard means the bonus-ratio update is skipped when a new lock is created from an expired one, leaving a stale ratio.
**Insight:** In lock/staking contracts, trace state variables (bonus ratios, multipliers) that are only refreshed on specific action branches; expired-lock edge cases can bypass the refresh and silently zero out rewards.