# Underflow of lpPosition.points during withdrawLP causes huge reward minting

Rounding in NeoTokyoStaker LP points lets a staker underflow lpPosition.points on withdraw, minting >1e64 BYTES rewards via getReward.

- Payout: Contest reward
- Severity: high
- Program: Neo Tokyo
- Credited: rokso
- Disclosed: 2023-04-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-03-neotokyo-findings/issues/261
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-neotokyo%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** NeoTokyoStaker LP staking/withdraw and BYTES reward minting
**Root cause:** LP points are computed with integer division that rounds down; staking in two chunks and withdrawing the sum yields points = 0*2 - 1, underflowing uint256 to type(uint256).max.
**Steps:**
1. Configure LP token via `configureLP(LPToken.address)`
2. Alice stakes `10.009e18` LP for 30 days via `stake(ASSETS.LP.id, TIMELOCK_OPTION_IDS[30], amount1, 0, 0)`
3. Alice stakes `11.009e18` LP for 30 days similarly
4. Bob stakes `10e18` LP for 30 days
5. Advance time past 30-day lock via `evm_setNextBlockTimestamp`
6. Alice calls `withdraw(ASSETS.LP.id, amount1.add(amount2))` triggering points underflow
7. Alice calls `NTBytes2_0.getReward(alice.address)` minting >3e64 BYTES
**How found:** Auditor reviewed the points accounting in withdrawLP (L1622-1631) and noticed integer division rounding combined with subtraction could underflow when multiple small stakes are aggregated on withdraw.
**Exploitation:** Attacker stakes LP in two amounts whose per-stake points round to 0, then withdraws the combined amount so points = 0*2 - 1 underflows to uint256 max; getReward then mints astronomically large BYTES to the attacker.
**Insight:** When a position's points are recomputed as `newPoints = oldPoints*2 - withdrawnPoints` style arithmetic, test stake/withdraw amounts that round to zero individually but differ when summed; rounding-down plus subtraction is a classic underflow vector.