# Broken assumptions can lead to the inability to seize RSR

Frontrunning seizeRSR by unstaking then staking 2 wei leaves totalStakes=0 with stakeRSR=2, driving stakeRate to 0 and reverting seize via division by zero.

- Payout: Audit contest
- Severity: medium
- Program: Reserve
- Found by: krikolkk
- Disclosed: 2024-10-03
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-07-reserve#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:accounting-error vuln:business-logic vuln:dos

**Target:** stRSR staking contract seizeRSR / stakeRate accounting
**Root cause:** Invariant totalStakes==0 implies stakeRSR==0 is not enforced; mintStakes truncates to 0 when stakeRate<5e17, leaving stakeRSR>0 with totalStakes==0. seizeRSR then recomputes stakeRate as 0 and exchangeRate() divides by zero.
**Steps:**
1. Stake 5000e18 RSR; mint rewards and call payoutRewards twice across days to push stakeRate to ~5e17-1.
2. Unstake 4999e18 leaving 1e18 staked.
3. In one tx (SeizeAttacker): unstake last 1e18, approve 2 wei, stake(2) — mintStakes computes (499999999999999999*(0+2))/1e18 = 0, so totalStakes=0 while stakeRSR=2.
4. Impersonate BackingManager and call `stRSR.seizeRSR(2499e18)`.
5. stakeRSRToTake=1, stakeRSR=1, stakeRate recomputed as (1e18*0+(1-1))/1 = 0; `emit ExchangeRateSet(initRate, exchangeRate())` reverts with panic 0x12 (division by zero).
**How found:** Reasoned about broken assumptions between stakeRSR and totalStakes during unstake/stake cycles; noticed mintStakes truncation to zero when stakeRate is below 5e17, then traced seizeRSR's stakeRate recomputation and exchangeRate() division to a zero-denominator revert.
**Exploitation:** Last staker frontruns the BackingManager seizeRSR transaction, atomically unstaking the final token and re-staking 2 wei so totalStakes becomes 0 while stakeRSR stays nonzero; the subsequent seize reverts, DoSing the necessary rebalance.
**Insight:** When a share/rate system truncates minted shares to zero, the underlying asset counter can advance while total shares stay zero — hunt for invariants like 'zero shares implies zero assets' and check downstream divisions by the recomputed rate.