# Error in Updating _checkpoint in the increaseUnlockTime Function

increaseUnlockTime set oldLocked.end to the new unlock time instead of the old one, corrupting checkpoint bias and slopeChanges so voting power and total supply were misreported.

- Payout: Contest reward
- Severity: medium
- Program: FIAT DAO
- Credited: Aymen0909
- Disclosed: 2022-10-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-fiatdao-findings/issues/217
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** VotingEscrow.sol increaseUnlockTime / _checkpoint
**Root cause:** In increaseUnlockTime, oldLocked.end is assigned unlock_time (the new end) instead of oldUnlockTime, so _checkpoint receives identical old and new end values, making userOldPoint.bias equal userNewPoint.bias and corrupting PointHistory bias and slopeChanges.
**Steps:**
1. Call increaseUnlockTime with a new _unlockTime greater than locked_.end.
2. Observe line 513: `oldLocked.end = unlock_time;` instead of `oldLocked.end = oldUnlockTime;`.
3. _checkpoint computes `userOldPoint.bias = userOldPoint.slope * int128(_oldLocked.end - block.timestamp)` using the new end, so old bias equals new bias.
4. lastPoint.bias update `lastPoint.bias + userNewPoint.bias - userOldPoint.bias` nets zero change, and slopeChanges[_oldLocked.end] is written at the wrong timestamp.
5. Query balanceOfAt/totalSupplyAt/totalSupply to see incorrect voting power at given blocks.
**How found:** Code review of increaseUnlockTime against the CheckpointMath.md specification table, noticing oldLocked.end was set to unlock_time rather than oldUnlockTime, contradicting the documented old/new checkpoint semantics.
**Insight:** When a contract documents checkpoint invariants (old vs new lock fields), diff each assignment against that spec table; a single wrong field assignment in the 'old' struct silently zeroes out bias deltas and misplaces slopeChanges entries.