# In ReaperVaultV2, we should update lockedProfit and lastReport before changing lockedProfitDegradation

ReaperVaultV2 setLockedProfitDegradation changes degradation without checkpointing lockedProfit/lastReport, letting a depositor front-run to capture newly unlocked yield.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: hansfriese
- Disclosed: 2023-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/728
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ReaperVaultV2 vault contract (Solidity)
**Root cause:** setLockedProfitDegradation updates the degradation coefficient without first checkpointing lockedProfit and lastReport, so the new rate is applied retroactively to the entire elapsed period since last report.
**Steps:**
1. Assume lockedProfit=200, lastReport=now, degradation=6h after report().
2. Wait 3h without report(): 100 tokens unlocked under old rate.
3. Admin calls setLockedProfitDegradation(4h); recompute gives 200*3/4=150 unlocked, +50 free funds in same block.
4. Attacker front-runs the admin tx with a large `deposit()` to capture most of the 50 newly freed tokens.
**How found:** Code reading of _calculateLockedProfit vs setLockedProfitDegradation: noticed the setter mutates the rate without checkpointing state, making the change retroactive over the elapsed window.
**Exploitation:** Whitelisted depositor observes pending admin setLockedProfitDegradation tx lowering degradation, front-runs with a large deposit to dilute existing holders and absorb the retroactively unlocked yield, then withdraws.
**Insight:** When a config parameter multiplies elapsed time since a checkpoint, changing it without first settling the accumulator retroactively rewrites history; look for setters of rate/coefficient variables that lack a checkpoint update.