# Attacker Can Desynchronize Supply Snapshot During Same-Block Unstake, Reducing Everyone’s Rewards

Same-block unstake during snapshot leaves supply recorded pre-burn but balance post-burn, shrinking reward shares below 100% for all stakers.

- Payout: Contest reward
- Severity: medium
- Program: Cabal
- Credited: maxzuvex
- Disclosed: 2025-05-28
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-04-cabal-liquid-staking-token#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Move LST token snapshot/reward accounting (cabal_token, voting_reward)
**Root cause:** cabal_token::burn does not update the supply snapshot for the current block (unlike mint_to), and check_snapshot skips writing the user's balance when current_block_height == snapshot_block, so reward calc mixes pre-burn supply with post-burn balance.
**Steps:**
1. Monitor mempool for manager's `voting_reward::snapshot()` tx targeting block H.
2. Submit `cabal::initiate_unstake` to land in same block H.
3. `cabal_token::check_snapshot` early-returns (H == snapshot_block), skipping balance write for H.
4. `cabal_token::burn` reduces live supply but leaves `supply_snapshots[H]` at pre-burn S0.
5. At reward calc, `get_snapshot_supply(H)` returns S0; `get_snapshot_balance_internal` finds no entry and falls back to live post-burn balance.
6. Shares sum to <1, underpaying all stakers for cycle H.
**How found:** Code review comparing burn vs mint_to snapshot handling and check_snapshot's same-block early-return, then tracing get_snapshot_balance_internal fallback to live balance.
**Exploitation:** Attacker with LSTs front-runs/co-includes an unstake in the snapshot block via mempool monitoring, sacrificing only their own one-cycle reward while reducing everyone's payout; repeatable each epoch as grief/extortion.
**Escalation:** Repeatable per epoch; can be threatened for extortion; cycle corruption is permanent without state migration.
**Insight:** When a protocol snapshots supply and per-user balances separately, audit every mutation path (burn, transfer, mint) for whether it updates the snapshot table on the snapshot block; asymmetric handling between mint and burn is a classic desync vector.