# Users can lock funds for less time than the minimum staking duration

Goat staking Controller lets users add funds to an existing lock with less than the 30-day minimum remaining, locking new funds for an arbitrarily short period.

- Payout: Contest reward
- Severity: medium
- Program: Goat
- Credited: ethan
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.2.16
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.16
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solidity vuln:business-logic

**Target:** Staking Controller / LHelper.calMintStakingPower
**Root cause:** When adding to an existing lock without extending duration, calMintStakingPower only requires restDuration > 0 instead of restDuration > minDuration_, so new funds inherit a near-expired lock.
**Steps:**
1. Create a lock position and let its remaining duration drop below the 30-day minimum (but > 0).
2. Call the stake/mint path with lockTime_ == 0 to add funds to the existing position.
3. Observe calMintStakingPower passes with `require(rd > 0)` only, accepting the short remaining duration.
4. New funds are locked for the short remainder, violating the minimum staking duration.
**How found:** Code reading of calMintStakingPower: noticed minimum amount is enforced in all cases but duration is only checked as > 0 when extending an existing lock, contradicting the explicit minimum staking duration.
**Insight:** When a protocol enforces a minimum on one dimension (amount) but a related dimension (duration) is only checked as nonzero on the top-up path, compare the two enforcement paths for asymmetry.