# Award is still distributed when there aren't any stakers, allowing users to get reward without staking

MuteAmplifier skips weight update when totalStake is zero, so a user who stakes and instantly withdraws captures all rewards accrued during the no-staker period.

- Payout: Contest reward
- Severity: medium
- Program: Mute.io
- Credited: evan
- Disclosed: 2023-04-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-03-mute-findings/issues/41
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** MuteAmplifier staking/reward contract
**Root cause:** The update modifier only advances _mostRecentValueCalcTime and _totalWeight when totalCurrentStake > 0, so reward accrued while no one staked is applied to the next staker's weight; _userWeighted is snapshotted at stake time before that update.
**Steps:**
1. Start staking period with totalStake()==0.
2. Call `stake(1)` then `withdraw()` in same tx: update no-ops (totalStake 0), _userWeighted[account]=_totalWeight unchanged.
3. Advance time to near staking_end.
4. Call `stake(1)` then `withdraw()`: now totalStake>0, update adds sinceLastCalc*perSecondReward/totalCurrentStake to _totalWeight.
5. _applyReward computes reward = lpTokenOut*(_totalWeight-_userWeighted[account])/multiplier, paying out the whole no-staker period reward.
**How found:** Code reading of the update modifier: noticed _mostRecentValueCalcTime and _totalWeight only update inside the totalCurrentStake>0 branch, and that _userWeighted is set before that update, so a stake/withdraw pair around a zero-stake window captures the delta.
**Exploitation:** Attacker stakes minimal LP and immediately withdraws to set firstStakeTime and leave totalStake at 0, waits, then stakes 1 wei and withdraws to harvest all rewards accrued during the empty period, also diluting perSecondReward for honest stakers.
**Insight:** In reward-accrual contracts, check whether the accumulator timestamp/weight is advanced on every state-changing call or only when total stake is nonzero; a zero-total window plus a snapshot-before-update ordering lets the next entrant claim the whole gap.