# Last user will be unable to claim collateral gain in StabilityPool in some case

StabilityPool._overwriteCollateral fails to reset lastCollateralError_Offset, so rounding remainder inflates distributed collateral gains and the last claimant's transfer reverts.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: T1MOH
- Disclosed: 2025-02-05
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.8
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.8
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:accounting-error vuln:dos vuln:precision-loss

**Target:** StabilityPool.sol collateral sunset/overwrite logic
**Root cause:** _overwriteCollateral() replaces the collateral token at an index but does not zero lastCollateralError_Offset[idx], so a stale rounding remainder is reused when recalculating gains during offset().
**Steps:**
1. Deposit into StabilityPool and trigger a liquidation so collateral gains accrue and lastCollateralError_Offset becomes nonzero.
2. Claim gains, then call startCollateralSunset(stakedBTC2) and wait for sunset expiration.
3. Deploy a new collateral/TroveManager instance and open troves; liquidate one to accrue gains at the reused index.
4. Claim gains for both depositors: the final claimCollateralGains reverts with `ERC20: transfer amount exceeds balance` because summed gains exceed actual balance.
**How found:** Reviewed _overwriteCollateral and noticed it overwrites the collateral token but leaves lastCollateralError_Offset untouched; recalled a similar prior report (Cyfrin 7.3.16 / Prisma commit 0915dd49) whose fix was incomplete, then built a Foundry PoC reproducing the revert.
**Exploitation:** No attacker profit; the inflated rounding remainder causes total distributed collateral gain to exceed the pool's actual balance, so the last user to claim cannot withdraw their reward (DoS on last claimant).
**Insight:** When a contract reuses a storage slot for a new asset/index, audit every per-index accumulator and rounding-remainder variable for reset — partial fixes that only clear one field (e.g. depositSums) leave sibling fields like error offsets to inflate totals.