# Users can claim extremely large rewards or lock rewards from LpGauge due to uninitialised poolLastUpdate variable

Uninitialised poolLastUpdate in LpGauge lets a pre-initialisation staker checkpoint a huge integral and claim most governance rewards or block others.

- Payout: Contest reward
- Severity: medium
- Program: Backd
- Credited: scaraven
- Disclosed: 2022-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-backd-findings/issues/141
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-backd%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** LpGauge / StakerVault reward accounting contracts
**Root cause:** poolLastUpdate defaults to 0 and is not set in the constructor; _poolCheckPoint computes poolStakedIntegral using block.timestamp - 0, producing an enormous integral once staked amount > 0.
**Steps:**
1. Deploy LpGauge and StakerVault; LpGauge address still zero in StakerVault.
2. Before initializeLpGauge(), user A calls `stakeFor()` with 1 token, raising `_poolTotalStaked`; `_userCheckPoint()` is skipped since lpgauge is zero address, so `poolLastUpdate` stays 0.
3. User A calls `_userCheckPoint()`/`poolCheckpoint()` directly, allocating a huge share count from the inflated integral.
4. After `initializeLPGauge()`, user A calls `claimRewards()` to take most governance tokens, or inflated `poolStakedIntegral` exceeds Minter limit so no one can claim.
5. Alternate path: new LpGauge added via `prepareLPGauge()` (3-day delay before `executeLPGauge()`), monitor and checkpoint during the window.
**How found:** Code reading of _poolCheckPoint revealed lastUpdated/poolLastUpdate never initialised, and tracing stakeFor before initializeLpGauge showed the checkpoint path is skipped leaving the variable at 0.
**Exploitation:** Attacker stakes a minimal amount before gauge initialisation, then checkpoints to accrue a massive integral, and after initialisation claims nearly all available governance token rewards (or griefs others by exceeding the mint cap).
**Insight:** In reward-accrual contracts, check whether accumulator timestamps are set in the constructor and whether staking/checkpoint paths are reachable before the gauge address is wired up; a zero timestamp turns elapsed-time math into a near-infinite integral.