# Wrong Reward Slashing in UnwindingModule::startUnwinding causing loss of protocol funds

UnwindingModule::startUnwinding divides by slashIndex instead of multiplying, inflating rewardWeight so users claim more rewards than owed after losses.

- Payout: Contest reward
- Severity: high
- Program: infiniFi
- Credited: Bizarro
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** UnwindingModule smart contract (startUnwinding)
**Root cause:** rewardWeight and targetRewardWeight use divWadDown(slashIndex) instead of mulWadDown; since slashIndex is in (0,1e18], dividing increases rather than slashes the reward.
**Steps:**
1. Deploy/enter test env; create positions for alice (1000,10) and bob (2000,5)
2. alice approves gateway and calls `gateway.startUnwinding(1000, 10)`
3. advanceEpoch(6); `_depositRewards(330)`
4. call `_applyLosses(3330/2)` to lower slashIndex below 1e18
5. advanceEpoch(1); create another alice position (1000,10)
6. alice calls `gateway.startUnwinding(1000, 10)` again; rewardWeight = _rewardWeight.divWadDown(slashIndex) exceeds _rewardWeight, assertion `rewardWeight <= _rewardWeight` fails (panic 0x01)
**How found:** Code review of reward math: noticed slashIndex semantics (starts at 1e18, decreases on losses) contradict the division used in startUnwinding, then wrote a Foundry test asserting rewardWeight <= _rewardWeight to confirm inversion.
**Exploitation:** After applyLosses reduces slashIndex, any user starting unwinding gets rewardWeight inflated by 1/slashIndex, letting them claim more rewards than entitled and draining the reward pool.
**Insight:** When a scaling factor is designed to reduce a value (starts at 1e18 and only decreases), verify the operation direction—division by a sub-1 WAD inflates; assert monotonic invariants like rewardWeight <= input in tests.