# StRSR: seizeRSR function fails to update rsrRewardsAtLastPayout variable

StRSR.seizeRSR drains reward RSR without resetting rsrRewardsAtLastPayout, so the next _payoutRewards over-mints stakeRSR and can underflow-revert rsrRewards, temporarily DoSing stake/unstake/seize.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: HollaDieWaldfee
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-reserve-findings/issues/64
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-23
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** StRSR staking contract (Solidity, RToken protocol)
**Root cause:** seizeRSR removes RSR from the rewards pool but does not update rsrRewardsAtLastPayout, so _payoutRewards computes payouts against a stale, too-large reward balance.
**Steps:**
1. BackingManager calls `StRSR.seizeRSR` on an under-collateralized RToken, pulling RSR from stakeRSR, draftRSR, and rewards.
2. rsrRewardsAtLastPayout remains at its pre-seizure value.
3. Call `StRSR._payoutRewards` (via stake/unstake): stakeRSR is increased by an amount larger than actual rewards available.
4. `rsrRewards()` computes `rsr.balanceOf(this) - stakeRSR - draftRSR`, which can underflow and revert.
5. Any subsequent seizeRSR or stake/unstake reverts until more RSR accrues or is donated.
**How found:** Code review of seizeRSR vs _payoutRewards: noticed seizeRSR claims from the rewards pool but never resets rsrRewardsAtLastPayout, then traced the downstream effect on stakeRSR and the rsrRewards subtraction.
**Exploitation:** Not attacker-triggered; occurs naturally when BackingManager seizes RSR from an under-collateralized RToken, leaving stale reward accounting that can revert stake/unstake/seize until RSR balance recovers.
**Insight:** When a function drains a pool that a separate accounting variable tracks (here rsrRewardsAtLastPayout), check whether that variable is resynced; stale-tracker bugs surface as over-minting and underflow reverts in derived balance computations.