# Users can dodge losses due to StRSR era changes with instant operations

StRSR era resets on stakeRate/draftRate can be sandwiched via unstake/cancelUnstake, letting users dodge collectivized seizure losses and skim leftover RSR.

- Payout: Audit contest
- Severity: medium
- Program: Reserve
- Found by: RadiantLabs
- Disclosed: 2024-10-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-07-reserve#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StRSR.sol staking contract (seizeRSR era wrapping)
**Root cause:** stakeRate and draftRate wrap to 1.0 independently when exceeding MAX_STAKE_RATE/MAX_DRAFT_RATE, and unstake/cancelUnstake move funds between stakeRSR and draftRSR buckets, so a user can sit in the bucket not being reset during the seizeRSR transaction.
**Steps:**
1. Observe pending seizeRSR tx that will push stakeRate over MAX_STAKE_RATE and trigger beginEra().
2. Front-run with `unstake(amount)` to move funds from stakeRSR into draftRSR bucket.
3. Let seizeRSR execute; stakeRate wraps to 1.0, existing stakers eat the loss.
4. Call `cancelUnstake(amount)` to return funds to stakeRSR at the fresh rate.
5. Mirror sequence (cancelUnstake then unstake) to dodge a draftRate wrap.
**How found:** Code review of seizeRSR noting stakeRate and draftRate reset independently, and that rewards only affect stakeRate, so the two wraps occur at different times; then reasoning that bucket-switching via unstake/cancelUnstake lets a user choose which side of the reset to be on.
**Exploitation:** Attacker monitors mempool for seizeRSR that will wrap one rate, sandwiches it with unstake/cancelUnstake (or reverse) so their balance is in the non-reset bucket during the wrap, paying only pro-rata seizure while others absorb the full reset loss and leftover RSR is redistributed to them.
**Insight:** When a contract resets exchange rates per-bucket on a threshold, check whether users can move funds between buckets atomically around the triggering tx; independent reset conditions for correlated rates create a free option to dodge socialization of losses.