# Loss of staking yield for stakers when another user stakes in pause/frozen state

StRSR.stake skips _payoutRewards while paused/frozen, letting a new staker capture a share of accrued yield without waiting a reward period.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: Soosh
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-reserve-findings/issues/148
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** StRSR staking contract (stake/_payoutRewards)
**Root cause:** stake() only calls _payoutRewards() when not pausedOrFrozen, so rewards accrued before the pause are not checkpointed; a staker joining during pause immediately shares in the unclaimed accrued yield.
**Steps:**
1. addr1 approves and stakes RSR in stRSR
2. advanceTime(rewardPeriod * 5) to accrue rewards
3. owner calls main.pause()
4. addr2 approves and stakes same amount while paused (no _payoutRewards)
5. owner unpauses; both unstake and advanceTime(unstakingDelay+1)
6. both withdraw; balances approximately equal, showing addr2 captured half of addr1's accrued yield
**How found:** Code reading of stake() noting the conditional `if (!main.pausedOrFrozen()) _payoutRewards();` and reasoning that rewards are not checkpointed during pause, then validating with a Foundry/Hardhat test comparing final balances.
**Exploitation:** Attacker waits for a pause/freeze window after a long period without stake/unstake/payoutRewards calls, stakes an amount comparable to existing stakers, then unstakes after unpause to collect a proportional share of yield accrued entirely by prior stakers.
**Insight:** When a reward-accrual function is gated behind a pause check, look for state-changing entrypoints (stake/deposit/mint) still allowed during pause that share in un-checkpointed accrual — the missing checkpoint is the bug, not the pause itself.