# Lock.sol: assets deposited with Lock.extendLock function are lost

Lock.extendLock increases a bond's locked amount but never increments totalLocked, so release underflows and the extra principal is permanently stuck.

- Payout: Contest reward
- Severity: high
- Program: Tigris Trade
- Credited: HollaDieWaldfee
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/23
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Lock.sol bond contract (extendLock/release accounting)
**Root cause:** extendLock adds to the bond's lockAmount but does not increment totalLocked[_asset], while release decrements totalLocked by the full lockAmount, causing an underflow revert.
**Steps:**
1. Call `lock(StableToken, 100e18, 9)` to create bond 1; totalLocked = 100e18.
2. Approve and call `extendLock(1, 10e18, 0)`; bond lockAmount = 110e18 but totalLocked stays 100e18.
3. Advance time past expiry (`evm_increaseTime 864000`).
4. Call `release(1)`; `totalLocked[asset] -= 110e18` underflows and reverts, so the 110e18 cannot be withdrawn.
**How found:** Code reading of the two deposit paths (lock vs extendLock) against the single release path, noticing totalLocked is only incremented in lock but decremented by the full lockAmount in release.
**Insight:** When a contract has multiple entry points that increase a user position, diff each one against the single exit path's accounting variable—any increment missing in one path becomes a permanent lock or underflow on withdrawal.