# Slashed UnwindingModule is penalized in future rewards, unfairly

UnwindingModule.applyLosses reduces slashIndex, which also shrinks totalRewardWeight, so the module is double-penalized in future reward allocation.

- Payout: Contest reward
- Severity: high
- Program: infiniFi
- Credited: KupiaSec
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.1.6
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** UnwindingModule / LockingController reward accounting (Solidity)
**Root cause:** applyLosses scales slashIndex down by the loss ratio, and totalRewardWeight() multiplies by slashIndex, so a slashed module's reward weight shrinks beyond the actual loss.
**Steps:**
1. Observe `applyLosses(_amount)` burns receipt tokens and sets `slashIndex = slashIndex.mulDivDown(totalReceiptTokens - _amount, totalReceiptTokens)`.
2. Note `totalRewardWeight()` returns `point.totalRewardWeight.mulWadDown(slashIndex)`.
3. In `LockingController.depositRewards`, unwindingRewards = `_amount.mulDivDown(unwindingRewardWeight, _globalRewardWeight + unwindingRewardWeight)`.
4. Trigger a loss via applyLosses; slashIndex drops, unwindingRewardWeight drops, so UnwindingModule receives a smaller share of future rewards on top of the loss.
**How found:** Code reading of applyLosses and totalRewardWeight, noticing slashIndex is reused as a multiplier in reward-weight computation consumed by depositRewards.
**Insight:** When a slashing index is reused as a multiplier in unrelated accounting (reward weights), a single loss event silently compounds into a second penalty; trace every consumer of a slash/scale index for double-counting.