# Rebases can be frontrun with very little token downtime even when warmUpPeriod > 0

Stake one block before epoch end to bypass forced rebase, then instantUnstakeCurve next block to collect rebase rewards with minimal token downtime.

- Payout: Contest reward
- Severity: medium
- Program: Yieldy
- Credited: 0x52
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-yieldy-findings/issues/31
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Staking.sol rebase/warm-up logic
**Root cause:** stake() only forces rebase when epoch.endTime <= block.timestamp, so staking the block before epoch end skips it; instantUnstakeCurve then triggers the rebase and unstakes warm-up funds using userWarmInfo.credits, retaining rebase rewards.
**Steps:**
1. Wait until one block before epoch.endTime.
2. Call `stake()` with desired amount; forced rebase at L416 is skipped since epoch.endTime > block.timestamp, creating warmUpInfo with deposit.
3. Next block call `instantUnstakeCurve()`; L633 rebase now fires (epoch.endTime <= block.timestamp) distributing pending rewards.
4. `_retrieveBalanceFromUser` (L617) returns warm-up funds; unstake uses userWarmInfo.credits so rebase rewards are kept.
**How found:** Code reading of stake()'s conditional forced rebase (L415-417) versus instantUnstakeCurve's rebase call (L633), noticing the epoch boundary can be straddled across two blocks.
**Exploitation:** Attacker stakes just before epoch end, then immediately instant-unstakes the next block after rebase fires, capturing rebase rewards with only ~1 block of token exposure.
**Insight:** When a function conditionally triggers a state update based on a time boundary, check whether splitting the action across the boundary (stake before, unstake after) lets you skip the guard yet still receive the update's benefit.