# Staker rewards can be gathered with maximal multiplier no matter how borrowers are overdue

Union Finance resets vouch.lastUpdated on any borrow, so overdue borrowers' stakers show zero frozen coin age and claim max 2x UNION rewards.

- Payout: Contest reward
- Severity: high
- Program: Union Finance
- Credited: hyh
- Disclosed: 2022-11-04
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-union-finance-judging/issues/74
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-union-finance%3AH-5
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** UserManager.sol staker reward/frozen-age accounting
**Root cause:** updateLocked() sets vouch.lastUpdated to current block on every borrow, including repetitive minimal borrows, and getFrozenInfo() derives frozen coin age from lastUpdated, so overdue debt appears fresh.
**Steps:**
1. Staker Bob vouches for borrower(s) with overdue debt.
2. Bob asks borrower to borrow minimal amount (`1.0 DAI`) via market, triggering `updateLocked(borrower, amount, true)`.
3. `vouch.lastUpdated = uint64(block.number)` is reset, making `getFrozenInfo()` compute diff≈0 and memberTotalFrozen≈0.
4. Bob calls `UserManager.withdrawRewards()` to claim UNION at maximal `2x` multiplier.
5. Repeat before each withdrawal/unstake; cost is only gas plus minimal borrow interest.
**How found:** Code reading of updateLocked() showed lastUpdated is bumped on both lock and unlock paths, then traced getFrozenInfo() using lastUpdated as the overdue proxy, revealing repetitive borrows erase the frozen penalty.
**Exploitation:** Colluding staker and borrower repeatedly take minimal loans to reset lastUpdated, zeroing frozen coin age so reward multiplier stays maximal despite overdue debt, diluting UNION supply at other holders' expense.
**Insight:** When a reward/health metric keys off a 'last activity' timestamp, check every code path that writes it — routine top-ups or partial actions that reset the clock can erase penalties meant to reflect delinquency.