# ConvexStakingWrapper.sol after shutdown，rewards can be stolen

After shutdown, ConvexStakingWrapper skips checkpoints, so new recipients of transferred tokens have zero reward_integral_for and can claim inflated rewards repeatedly.

- Payout: Contest reward
- Severity: high
- Program: Reserve
- Credited: bin2chen
- Disclosed: 2023-11-13
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/11
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** ConvexStakingWrapper.sol staking/reward contract
**Root cause:** _checkpoint returns early when isShutdown() is true, so _beforeTokenTransfer never updates reward.reward_integral_for for senders/recipients, leaving new holders with a stale zero integral.
**Steps:**
1. Trigger/observe shutdown state so isShutdown() returns true.
2. Alice transfers 100 tokens to fresh address Bob; _beforeTokenTransfer->_checkpoint returns early, so balanceOf[bob]=100 and reward.reward_integral_for[bob]=0 while reward.reward_integral=1000.
3. Bob calls claimRewards(); payout = balanceOf[bob]*(reward_integral - reward_integral_for[bob]) = 100*1000.
4. Bob transfers balance to another fresh address and repeats to drain all rewards.
**How found:** Code reading of _checkpoint's early return on isShutdown() combined with the reward formula balanceOf*(reward_integral - reward_integral_for[user]) to spot that new holders never get their integral initialized.
**Exploitation:** Attacker waits for shutdown, then cycles tokens through fresh addresses; each new address claims rewards computed against a zero reward_integral_for, extracting the full accumulated integral per token repeatedly until rewards are drained.
**Escalation:** Looping transfers to new addresses scales the single over-claim into draining the entire reward pool.
**Insight:** When a reward-accounting checkpoint is gated behind a state flag (shutdown/pause), check whether per-user accumulators can remain uninitialized for new holders; any transfer path that skips checkpointing lets fresh addresses claim the full integral.