# function lockFunds in TopUpActionLibrary can cause serious fund lose. fee and Capped bypass. It's not calling stakerVault.increaseActionLockedBalance when transfers stakes.

TopUpActionLibrary.lockFunds transfers staked LP without calling increaseActionLockedBalance, desyncing stakedAndActionLockedBalanceOf and enabling depositCap and fee bypass plus reward loss.

- Payout: Audit contest
- Severity: high
- Program: Backd
- Credited: unforgiven
- Disclosed: 2022-06-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-04-backd-findings/issues/60
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-backd%3AH-02
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** TopUpActionLibrary.lockFunds / StakerVault accounting
**Root cause:** lockFunds moves stakes via stakerVault.transferFrom but never calls stakerVault.increaseActionLockedBalance(payer, amount), so actionLockedBalances[payer] stays zero while the position holds the deposit.
**Steps:**
1. Deposit funds to Pool, receive LP tokens.
2. Stake LP tokens in StakerVault.
3. Approve TopUpAction to transfer stakes.
4. Call TopUpAction.register() to create a position; lockFunds transfers stakes but leaves actionLockedBalances[user]=0.
5. Observe stakedAndActionLockedBalanceOf(user) returns 0 despite locked position.
6. Repeat deposit/stake/register to bypass depositCap in LiquidityPool.depositFor and fee in _updateUserFeesOnDeposit; reset TopUp positions to recover oversized stakes.
**How found:** Code review of lockFunds vs StakerVault accounting: noticed transferFrom without matching increaseActionLockedBalance, then traced all consumers of stakedAndActionLockedBalanceOf (depositFor cap check, _updateUserFeesOnDeposit, userCheckpoint).
**Exploitation:** Attacker cycles deposit->stake->register so stakedAndActionLockedBalanceOf reads zero, allowing deposits beyond max depositCap and avoiding early-withdraw fee penalties; then resets TopUp positions to withdraw stakes multiple times larger than the cap. Also causes honest users to lose LpGauge rewards since userCheckpoint computes zero.
**Escalation:** Repeated cycles scale bypassed deposits arbitrarily beyond the cap.
**Insight:** When a library moves staked balances between contracts, audit every paired accounting hook (transferFrom vs increase/decreaseActionLockedBalance); any getter used for cap or fee checks that reads a stale locked-balance mapping is a bypass primitive.