# YieldWUSDStaking.repay() may incorrectly over-refund remainAmount to user

YieldWUSDStaking._repay fails to zero remainAmount when it is less than unstakeFine, over-refunding the user and draining contract balance.

- Payout: Contest reward
- Severity: high
- Program: BendDAO
- Credited: bin2chen
- Disclosed: 2025-01-22
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-benddao-invitational#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-benddao-invitational%3AH-02
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high technique:source-review vuln:accounting-error vuln:business-logic

**Target:** YieldWUSDStaking.sol _repay() staking contract
**Root cause:** In the else branch where remainAmount < unstakeFine, the code adds the shortfall to extraAmount but never resets vars.remainAmount to 0, so the full remainAmount is later refunded to the NFT owner.
**Steps:**
1. Set unstakeFine=10, remainAmount=5 for a position.
2. Call repay() so _repay() executes the else branch: extraAmount += (10-5)=5.
3. remainAmount stays 5, assigned to sd.remainYieldAmount.
4. safeTransfer sends 5 to nftOwner as refund though it was consumed by the fine.
5. Repeat across positions to drain contract balance so collectFeeToTreasury() and other repayments fail.
**How found:** Code review of the _repay fine-computation branch, noticing the else path adjusts extraAmount but omits clearing remainAmount before it is used as the refund amount.
**Exploitation:** Attacker repays positions where remainAmount is below unstakeFine, receiving the remainAmount back as a refund while the fine is also charged to extraAmount, extracting funds and depleting the contract balance.
**Escalation:** Repeated over-refunds across many positions drain the pool, blocking other users' repayments and treasury fee collection.
**Insight:** When a branch splits a value into a charged portion and a remainder, check that the remainder variable is explicitly zeroed in every branch; here the shortfall branch leaves a stale positive remainAmount that is later paid out.