# Users can easily obtain new collateral by leveraging sunsetted collateral

StabilityPool stores collateral gains by array index, so after a sunsetted collateral is replaced, deferred gains are paid out in the new more valuable token.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: etherSky
- Disclosed: 2025-02-05
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StabilityPool.sol collateral gains accounting
**Root cause:** collateralGainsByDepositor is keyed by array index rather than token address; _overwriteCollateral reuses the same index for a new token, so unclaimed gains denominated in the old collateral are paid out in the new one.
**Steps:**
1. User1 provides debt tokens to StabilityPool via `provideToSP`
2. Liquidation offset credits 1e18 stakedBTC gain to User1
3. Owner calls `startCollateralSunset(stakedBTC)`; warp 200 days
4. User1 calls `claimReward(user1)` to snapshot gains without withdrawing
5. Owner enables new collateral via `enableCollateral(newCollateral)`, overwriting index 0
6. New collateral accumulates in pool via offsets
7. User1 calls `claimCollateralGains(user1, [0])` and receives 1e18 of the new, more valuable token
**How found:** Code review of _overwriteCollateral reusing the collateral array index while gains are stored per-index, noticing that claimReward snapshots gains without token identity.
**Exploitation:** Attacker defers claiming collateral gains until a sunsetted collateral is replaced by a much more valuable one, then claims the same unit amount in the new token, capturing value far exceeding the original gain at other depositors' expense.
**Insight:** When reward/gain accounting is keyed by array index and that array slot can be reassigned to a different asset, deferred claims silently change denomination — check every place an index is reused for a new token.