# increaseUnlockTime missing _checkpoint for delegated values

VotingEscrow.increaseUnlockTime skipped _checkpoint when caller is a delegatee, so a user delegating onward lost voting power from funds delegated to them.

- Payout: Contest reward
- Severity: medium
- Program: FIAT DAO
- Credited: PwnedNoMore
- Disclosed: 2022-10-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-fiatdao-findings/issues/318
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:governance

**Target:** VotingEscrow.sol increaseUnlockTime / delegate checkpointing
**Root cause:** increaseUnlockTime only calls _checkpoint inside the branch where the caller is not delegating; a user who is both delegatee and delegator never gets their delegated voting power checkpointed.
**Steps:**
1. Alice, Bob, Carol each hold locks with 10 delegate value, unlock 1 week
2. Alice calls `delegate(Bob)`; Bob calls `delegate(Carol)`
3. State: Alice 0, Bob 10, Carol 20 delegate value
4. Carol calls `increaseUnlockTime(2 weeks)` -> _checkpoint raises her power
5. Bob calls `increaseUnlockTime(2 weeks)` -> no checkpoint, his 10 delegated units yield no power increase
**How found:** Code reading of increaseUnlockTime: noticed _checkpoint guarded by an if on delegation status, and reasoned that a user can simultaneously be delegatee and delegator, a state the condition fails to cover.
**Exploitation:** Not an attack; a delegatee who delegates onward cannot realize voting power from funds delegated to them via increaseUnlockTime, understating their voting weight.
**Insight:** In ve-style escrow contracts, checkpoint logic gated on 'am I delegating' misses the dual role of delegatee-and-delegator; enumerate all states that mutate delegated balance (self-delegation, inbound delegation, outbound delegation) when auditing checkpoint conditions.