# Users emergency withdrawing will lose all past accrued rewards

GaugeV2.emergencyWithdraw lacks updateReward, so unaccrued rewards are zeroed when balance goes to 0, stranding tokens in the contract.

- Payout: Contest reward
- Severity: medium
- Program: Hybra Finance
- Credited: Huntoor
- Disclosed: 2025-11-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-10-hybra-finance#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** GaugeV2 staking gauge contract (Solidity)
**Root cause:** emergencyWithdraw() does not call the updateReward modifier, so rewards[account] is never checkpointed before _balanceOf drops to zero; earned() then computes rewards[account] + 0*(...) and the pending accrual is lost.
**Steps:**
1. Deploy GaugeV2 with HYBR as staking and reward token.
2. `gauge.deposit(100 ether)` to stake.
3. `gauge.notifyRewardAmount(address(hybr), 1000 ether)` to fund rewards.
4. `vm.warp(block.timestamp + 7 days / 14)` to accrue rewards; confirm `gauge.earned(this) > 0`.
5. `gauge.activateEmergencyMode()` then `gauge.emergencyWithdraw()`.
6. Observe `gauge.earned(this) == 0` and `hybr.balanceOf(address(gauge)) > 0` (rewards stuck).
**How found:** Code reading of the updateReward modifier and earned() formula: rewards are only checkpointed on deposit/withdraw/getRewards, so any path that zeroes balance without checkpointing (emergencyWithdraw) silently discards accrual.
**Exploitation:** Any staker who accrued rewards without a prior deposit/withdraw/getRewards checkpoint calls emergencyWithdraw after emergency activation; their balance becomes 0, earned() returns 0, and the unclaimed reward tokens remain locked in the gauge permanently.
**Insight:** When auditing reward-accounting contracts, enumerate every function that mutates user balance and check whether each one runs the reward-checkpoint modifier; emergency/admin exit paths are commonly missed and silently zero pending accrual.