# Attacker can take advantage of multiplier when there's only one second left, allowing them to fraudulently gain voting power

calMintStakingPower only requires rd>0, so staking a large loan with 1 second left mints near-full voting power for almost no lock time.

- Payout: Contest reward
- Severity: high
- Program: Goat
- Credited: 0xRajkumar
- Disclosed: 2024-06-12
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.1.9
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.9
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** staking/voting contract (calMintStakingPower, lockWithdraw)
**Root cause:** calMintStakingPower checks only rd>0 instead of enforcing _minDuration on the residual duration, so a fresh lockAmount_ added while an existing lock has ~1s left gets the full duration multiplier.
**Steps:**
1. Stake minimum amount (e.g. 7 Goat) for 1 month to create a lock with a long duration.
2. Wait until restDuration(oldLockData) is 1 second.
3. Flash-loan a large amount of Goat tokens.
4. Call stake with lockTime_=0 and the large lockAmount_; calMintStakingPower passes because rd>0 and computes multiplier for dLockForStakeA = 0 + 1s (~0.88).
5. Vote on target voteId with the inflated powerMinted.
6. Call lockWithdraw with isForced=true to exit early, paying fee + ~1s penalty, then repay the loan.
**How found:** Code review comparing the stake() require(duration_==0 || duration_>=_minDuration) guard against calMintStakingPower, which only checks rd>0; noticed the multiplier uses lockTime_+rd so a 1s residual still yields ~0.88x.
**Exploitation:** Attacker borrows a large Goat amount, stakes it in the final second of an existing lock to mint ~88% of full voting power, votes to steer a governance outcome and earn Geth, then force-withdraws paying only a small fee plus a 1-second proportional penalty (~3.8e13 wei on 100 Goat) — profitable whenever vote earnings exceed ~1e16 wei.
**Escalation:** Scales with loan size and low minStakeAmount; repeatable across votes as long as a residual lock exists.
**Insight:** When a duration/min-lock guard exists in one entry path, check every other path that computes the same multiplier from residual time — top-ups against an almost-expired lock bypass the minimum-duration intent.