# Unit isn't recalculated on curve modification with setCurvePoint

TimeLockPool.setCurvePoint changes curve length but never recomputes `unit`, so getMultiplier misprices lock durations, over- or under-awarding shares.

- Payout: Contest reward
- Severity: high
- Program: Merit Circle
- Credited: bin2chen
- Disclosed: 2022-10-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-merit-circle-judging/issues/101
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-merit-circle%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TimeLockPool.sol staking/lock multiplier contract
**Root cause:** `unit = maxLockDuration / (curve.length - 1)` is only recomputed in __TimeLockPool_init and setCurve, not in setCurvePoint, which can push/pop curve entries and change length.
**Steps:**
1. Deploy with curve length 6, so unit = maxLockDuration/5.
2. Gov calls `setCurvePoint(x, curve.length)` to push, or `setCurvePoint(x, curve.length+1)` to pop, changing curve.length to 7 or 5.
3. `unit` remains maxLockDuration/5.
4. Call `getMultiplier(2*maxLockDuration/5)`; with shortened curve length 3, n = 2 = curve.length-1, returning max multiplier for a 2/5 lock.
5. Deposit with that lockDuration to receive inflated shares (or fewer shares if curve lengthened).
**How found:** Code reading: noticed `unit` is recomputed in setCurve and init but not in the sibling setCurvePoint, which also mutates curve.length; traced getMultiplier's use of `unit` to show the duration-to-curve-index mapping breaks.
**Exploitation:** Governor-only curve edit is a routine setup op; after it, any depositor picking a lockDuration that maps past the shortened curve end receives the terminal max multiplier, minting excess shares redeemable for more tokens than deserved.
**Insight:** When a derived constant (unit) is cached from an array's length, audit every function that mutates that array's length, not just the obvious setter; sibling setters that push/pop are easy to miss.