# Stake before unfreeze can take away most of rsr rewards in the freeze period

Rewards accrue during freeze but only pay out at unfreeze, letting a front-runner stake just before unfreeze and capture most rsr rewards.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: ronnyx2017
- Disclosed: 2023-11-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-reserve-findings/issues/11
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** stRSR staking/reward contract (payoutRewards)
**Root cause:** _payoutRewards is skipped while frozen, so payoutLastPaid stays stale; on unfreeze the whole freeze period's rewards release at once to whoever holds stake at that block.
**Steps:**
1. Observe stRST.stake is the only allowed op during freeze and payoutRewards requires not frozen, so payoutLastPaid remains pre-freeze.
2. Wait until just before admin unfreezes; front-run by staking a large rsr amount into stRSR.
3. Admin unfreezes; next block _payoutRewards releases accumulated rewards proportional to current stake.
4. Attacker unstakes principal plus majority of rewards after unstakingDelay.
**How found:** Noticed payoutRewards is gated by requireNotFrozen and _payoutRewards skipped during freeze, so payoutLastPaid lags; reasoned that block.timestamp leap at unfreeze releases all accumulated rewards to current stakers.
**Exploitation:** Front-run the unfreeze transaction with a large stake, then unstake after the delay to collect a disproportionate share of the freeze-period rewards, risking only the unstakingDelay window.
**Insight:** When reward accrual is paused but timestamp-based, check whether a stale last-payout index lets a just-in-time staker capture the entire paused interval's rewards.