# Staking: the rebase function needs to be called before calling the function in the Yieldy contract that uses the rebasingCreditsPerToken variable

Staking unstake/claim/claimWithdraw read stale rebasingCreditsPerToken without calling rebase(), so users transact on outdated credit balances.

- Payout: Contest reward
- Severity: medium
- Program: Yieldy
- Credited: cccz
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-yieldy-findings/issues/126
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AM-19
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** Staking contract / rebasing token accounting
**Root cause:** Staking functions call Yieldy balanceOf/creditsForTokenBalance/transfer/mint/burn which depend on rebasingCreditsPerToken, but they don't trigger rebase() for the current epoch, so they operate on stale rebasing state.
**Steps:**
1. Observe Staking.unstake/claim/claimWithdraw call Yieldy functions using rebasingCreditsPerToken
2. Note rebase() is only invoked conditionally (if _trigger) in unstake and never in claim/claimWithdraw
3. Call claim/claimWithdraw or unstake(false) before the epoch's rebase has occurred
4. Yieldy credit/token conversions use outdated rebasingCreditsPerToken, producing incorrect balances/amounts
**How found:** Code reading: traced Staking functions into Yieldy functions that read rebasingCreditsPerToken and noticed rebase() was not guaranteed to run first.
**Exploitation:** Not described beyond the logic flaw; a user transacting before rebase gets incorrect credit-to-token conversions, potentially over- or under-redeeming.
**Insight:** When a rebasing token exposes conversion helpers, audit every external caller for whether it forces a rebase before reading those helpers; conditional rebase triggers (if _trigger) leave paths stale.