# Lack of timelock on rigidRedemption, enables to steal yield from other users

Lybra's rigidRedemption lacks the 3-day withdraw timelock, letting a user deposit just before a rebase, redeem immediately, and capture yield generated by others.

- Payout: Contest reward
- Severity: medium
- Program: Lybra Finance
- Credited: max10afternoon
- Disclosed: 2023-08-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-lybra-findings/issues/290
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** LybraEUSDVaultBase / LybraStETHDepositVault vault contracts
**Root cause:** withdraw() enforces a 3-day softlock via checkWithdrawal, but rigidRedemption() bypasses it, allowing near-instant exit of most collateral after deposit.
**Steps:**
1. Attacker deposits stETH into LybraStETHDepositVault via `depositAssetToMint` just before a rebase (front-run or predict daily stETH rebase).
2. Victim/anyone calls `excessIncomeDistribution(0.01e18)` distributing stETH yield to EUSD holders via rebase.
3. Attacker calls `becomeRedemptionProvider(true)` then `rigidRedemption(attacker, getBorrowedOf(attacker))` to repay debt 1:1.
4. Attacker calls `withdraw(attacker, depositedAsset(attacker))` paying only the 0.1% early-withdraw fee on remaining collateral.
5. Attacker calls `excessIncomeDistribution` again to reclaim stETH left in vault using rebase EUSD, netting positive stETH + EUSD.
**How found:** Noticed withdraw() applies a 3-day softlock with 0.1% penalty to prevent yield-hopping, then observed rigidRedemption() lets users exit most collateral instantly with no such lock, enabling the same hop-and-leave strategy.
**Exploitation:** Deposit right before rebase, redeem via rigidRedemption to skip the 3-day lock, withdraw remainder paying only the 0.1% fee, then re-buy leftover stETH with rebase EUSD; net gain exceeds fees when yield > 0.1%+0.5%.
**Insight:** When a protocol adds a softlock/fee to one exit path, check every other exit path (redemption, liquidation, transfer) for the same guard; asymmetric exit costs are a classic yield-farming arbitrage.