# Permanent funds lock in StargateRewardableWrapper

StargateRewardableWrapper's reward claim calls Stargate deposit(), which divides by totalAllocPoint; if admin zeroes it, all deposits/withdrawals revert and funds lock permanently.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: auditor0517
- Disclosed: 2023-11-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/27
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** StargateRewardableWrapper / RewardableERC20Wrapper staking wrapper
**Root cause:** _claimAssetRewards() calls stakingContract.deposit(poolId, 0), which invokes updatePool() that divides by totalAllocPoint; when Stargate admin sets totalAllocPoint to 0, the call reverts, and the wrapper has no emergencyWithdraw fallback.
**Steps:**
1. Stargate LPStaking pool exists with totalAllocPoint = 10; users deposit into StargateRewardableWrapper
2. Stargate admin calls set(0, 0) to remove the pool, making totalAllocPoint = 0
3. Any wrapper deposit/withdraw/transfer triggers _beforeTokenTransfer -> _claimAssetRewards -> stakingContract.deposit(poolId, 0) -> updatePool()
4. updatePool computes stargateReward.mul(1e12).div(lpSupply) with totalAllocPoint=0 in getMultiplier, reverting on division by zero
5. All wrapper entry points revert; no emergencyWithdraw path exists, so staked funds are permanently locked
**How found:** Code-reading of the wrapper's _claimAssetRewards() and tracing into Stargate LPStaking.deposit()/updatePool(), spotting the division by totalAllocPoint and noting the wrapper lacks the emergencyWithdraw escape hatch that Stargate exposes to normal users.
**Exploitation:** Not attacker-driven; requires Stargate admin to zero totalAllocPoint (e.g. removing a pool). Result is permanent lock of user funds in the wrapper since deposit/withdraw/transfer all revert.
**Insight:** When a wrapper delegates to an external staking contract, check every admin-mutable parameter used in the delegated call path (here totalAllocPoint) and whether the wrapper exposes the underlying contract's emergency escape hatch; missing it turns a benign admin action into permanent lock.