# Expired locks should not continue to earn rewards at the original high multiplier rate

Expired time-locks in Merit Circle's TimeLockPool kept earning the boosted high-multiplier APR while remaining freely withdrawable, overpaying rewards.

- Payout: Contest reward
- Severity: medium
- Program: Merit Circle
- Credited: WATCHPUG
- Disclosed: 2022-10-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-merit-circle-judging/issues/108
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-merit-circle%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** TimeLockPool.sol staking/rewards contract
**Root cause:** getMultiplier/reward accounting uses the deposit's original lock duration multiplier without checking whether block.timestamp has passed the lock end, so expired deposits retain the high multiplier.
**Steps:**
1. Deposit $MC into TimeLockPool with a long lock (e.g. 4 years) to receive boosted share multiplier (~10% APR vs 2% base).
2. Wait until the lock end timestamp passes; deposit is now withdrawable at any time.
3. Observe getMultiplier still returns the boosted rate for the expired deposit, so it accrues rewards at the high APR.
4. Withdraw principal while having earned excess rewards, diluting other stakers.
**How found:** Code review of TimeLockPool multiplier logic; noticed multiplier derived from lock duration without an expiry check, compared against Curve's veCRV kick() design for zeroed expired locks.
**Exploitation:** A staker locks tokens for the maximum duration to obtain the highest multiplier, waits for expiry, then continues collecting boosted rewards while free to withdraw at will, extracting more than the intended APR.
**Insight:** In vote-escrow/lock-boost reward contracts, check that the boost multiplier is recomputed or zeroed after lock expiry; compare against Curve Gauge kick() which burns excess shares of expired locks.