# MuteAmplifier.rescueTokens() checks the wrong condition for muteToken

MuteAmplifier.rescueTokens() fails to protect staker rewards when totalStakers==0 and ignores totalReclaimed, letting rewards be withdrawn or locked forever.

- Payout: Contest reward
- Severity: medium
- Program: Mute.io
- Credited: hansfriese
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-mute-findings/issues/32
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** MuteAmplifier Solidity contract rescueTokens()
**Root cause:** The muteToken branch of rescueTokens() only restricts withdrawals when totalStakers>0, and even then subtracts totalRewards-totalClaimedRewards without accounting for totalReclaimed, so reward funds are not properly reserved.
**Steps:**
1. Deploy/inspect MuteAmplifier with muteToken rewards funded and totalStakers==0 before staking ends.
2. Call `rescueTokens(muteToken, amount)` — no require triggers, so up to 100% of rewards can be withdrawn.
3. With totalStakers>0, call `rescueTokens(muteToken, amount)` where amount <= balance - (totalRewards - totalClaimedRewards); totalReclaimed is ignored, over-withdrawing.
4. Observe reward system underfunded or remaining rewards locked forever.
**How found:** Code review of rescueTokens() comparing the muteToken guard against the contract's reward accounting variables (totalRewards, totalClaimedRewards, totalReclaimed) and the staking lifecycle (totalStakers, endTime).
**Exploitation:** A privileged rescuer (or compromised admin) can drain reward tokens before staking begins, or over-withdraw beyond the totalReclaimed-adjusted reserve, breaking reward distribution and stranding funds.
**Insight:** When auditing rescue/withdraw functions, enumerate every accounting variable that reserves user funds (claimed, reclaimed, pending) and verify each is subtracted; also check guards that are skipped entirely on zero-state branches like totalStakers==0.