# RBS may redeploy funds automatically if price stays above or below wall for longer than _config.regenWait

RBS Operator regenerates a price wall and redeploys treasury funds when price stays outside the range past regenWait, buying/selling far from market price.

- Payout: Contest reward
- Severity: medium
- Program: Olympus DAO
- Credited: 0x52
- Disclosed: 2022-10-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/118
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** RBS Operator / RANGE module (Solidity smart contract)
**Root cause:** lastActive is only updated when a wall deactivates, so after a wall goes down it is never refreshed; once block.timestamp >= lastActive + regenWait and the observation count still meets regenThreshold, _regenerate fires even though price never returned inside the wall.
**Steps:**
1. Price sustains outside the range longer than config_.regenWait (high volatility or black swan).
2. Wall deactivates: capacity < threshold sets active=false and lastActive=block.timestamp in RANGE.sol; lastActive is not updated again while inactive.
3. Observation count accumulates; if config_.regenThreshold <= regenObserve - regenWait/frequency, _status.high.count >= regenThreshold becomes true.
4. Operator._regenerate(true) triggers, redeploying treasury funds at a wall price far from true market price.
**How found:** Code review of Operator.sol regenerate condition and RANGE.sol lastActive update logic; noticed lastActive freezes once a wall deactivates, then derived the parameter inequality under which the count threshold is still met.
**Exploitation:** No attacker action; misparameterization plus sustained out-of-range price causes the protocol itself to buy/sell treasury funds at stale wall prices, realizing loss.
**Insight:** When a timestamp is only written on state transition (wall down), check whether any later logic reads it as a liveness signal while the state is inactive; stale timestamps can satisfy time-gated conditions indefinitely.