# If all locked positions started unwinding and there is a full slash, minting of locked tokens is not paused

When all locked positions are unwinding and a full slash occurs, LockedController fails to pause, letting new users mint locked tokens that can never be unwound.

- Payout: Contest reward
- Severity: medium
- Program: infiniFi
- Credited: carlos404
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.2.11
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:business-logic vuln:dos

**Target:** LockedController / UnwindingModule slash accounting
**Root cause:** applyLosses returns early when _amount==0 after subtracting amountToUnwinding, skipping the pause that should trigger when the slash index hits zero; the prior fix only handled the case where a non-unwinding locked position exists.
**Steps:**
1. Honest user mints and locks 10M USDC via `gateway.mintAndLock`, then calls `gateway.startUnwinding` for all shares
2. Simulate full slash: burn all USDC in farm1.vault and mintController, then call `yieldSharing.accrue()`
3. Alice calls `gateway.mintAndLock(ALICE, 10_000e6, 1)` — succeeds despite slash index at 0
4. Alice calls `gateway.startUnwinding(...)` — reverts, funds permanently frozen
**How found:** Reviewer cross-referenced Spearbit issue 5.1.7 (slash index to 0 blocks startUnwinding) and noticed the applied fix only pauses when a non-unwinding locked position exists, missing the all-unwinding + full-slash edge case.
**Exploitation:** Attacker/user mints locked position tokens after a full slash while all existing locks are unwinding; the mint succeeds but startUnwinding reverts, permanently freezing the newly deposited funds.
**Insight:** When auditing a fix for a prior finding, enumerate the boundary conditions the patch's guard depends on (here: existence of a non-unwinding position) and test the complementary state where that guard is false.