# Permanent Locking of User Funds in the Stability Pool

Sunsetting collateral resets epochToScaleToSums to zero, so stale depositSums underflow in _accrueDepositorCollateralGain, permanently locking user deposits and rewards.

- Payout: Contest reward
- Severity: high
- Program: Bima
- Credited: etherSky
- Disclosed: 2025-02-05
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.1.3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** StabilityPool.sol collateral accounting
**Root cause:** _overwriteCollateral zeroes epochToScaleToSums[E][S][idx] while depositors retain nonzero depositSums for that index; when new collateral accrues a smaller sum, sumS[i] - depSums[i] underflows.
**Steps:**
1. User1 provides debtToken to SP; offset(stakedBTC,5e18,5e18) accrues gains; claimReward sets depositSums[1]=10000.
2. Owner calls startCollateralSunset(stakedBTC); warp 200 days; enableCollateral(newCollateral) triggers _overwriteCollateral zeroing epochToScaleToSums[E][S][1].
3. User2 provides debtToken; offset(newCollateral,5e18,1e18) raises epochToScaleToSums[E][S][1] to ~200 (<10000).
4. User1 calls withdrawFromSP/provideToSP/claimCollateralGains -> _accrueDepositorCollateralGain computes `sumS[i] - depSums[i]` -> underflow revert.
**How found:** Code reading of _overwriteCollateral's reset loop against _accrueDepositorCollateralGain's unchecked subtraction of depSums from sumS; hypothesized stale per-index depositSums surviving the reset, confirmed with a Foundry PoC toggling withdraw/provide/claim modes.
**Exploitation:** No attacker action needed; the sunset+replacement flow is permissionless/system-driven. Once the new collateral's accrued sum stays below the stale depositSums, the depositor's withdraw, deposit and reward-claim paths all revert, and an epoch/scale bump before catch-up permanently strands funds.
**Escalation:** If epoch or scale increments before epochToScaleToSums catches up, old-epoch sums are unreachable, converting temporary lock into total loss of principal and rewards.
**Insight:** When a contract reuses a fixed-size array index for swappable assets, check every place that index-keyed accumulator is zeroed versus per-user snapshots that persist; any subtraction of a persisted user sum from a reset global sum is an underflow/lock candidate.